I've had to de-hack quite a few of these, and I found a plug-in in the repository that will 1) Scan, 2) Fix, and 3) Alert you of any vulnerabilities.

http://wordpress.org/extend/plugins/timthumb-vulnerability-scanner/