Which version are you on? We had the same problem, but as far as I know, the dev team rescripted the header.php, and since that it works for us, running UNA13-B4. Some virus programs valued it as malware (trojan) and the vast majority of them didn't.

Edit: it is of corse not malware