z4root is in fact infected.
It is infected with an often used root exploit for Android 2.2 Froyo which allows you (or any malicious app) to gain root rights by executing it on a vulnerable phone. z4root is neutral if you have the original benign one however: It's only used to gain root. It does nothing else on its own.
AVG (and other antivirus vendors) flag this because it is a root exploit. They don't care if you like it or not and if you want to use it in a benign way (to install lag fix). It bypasses Android's security by exploiting a known vulnerability and this is enough to label it as infected.
To give an example:
Let's assume some app piggypacks this exploit to gain root to be able to start wreaking havoc on your phone (or with your data by formatting/wiping it. whatever).