Avira identifies something like C:\texlive\2009\texmf-dist\doc\pgfplots\pgfplots.pdf Such cases have always been a false positive, ie, bug in the virus program.