Just because a file shows up as infected doesn't mean it is, it could often be due to a hidden stub, a weird web.browser connection, etc, etc. Basically, its usually a false positive.
Saving password strings in a txt file whilst not encrypting it is dumb, if someone keylogs you they have a live cmd shell and they can identify where your file is via dir/cd or cd ../ combination's. Once discovered, they can access the file, save your passwords on a FTP server and move on. They can also use the search function on Windows.
I'd recommend encrypting pjpeg or an unidentified encryption string to prevent it though.
Download a file dissembler, and look for strings of "password, temp, regedit, pwd, pword, host, email, logins, savedata, etc, etc", often, you'll find api strings that should usually tell you that the file is infected. But some devs are smart, they PI encrypt their work.