What code should .htaccess of files directory hold in drupal 7.25?
The .htaccess you show is correct - it is actually the default .htaccess that Drupal versions above 7.24 (including the current 7.28) will generate for the files directory if the .htaccess file is missing.

In other words, the warning you get from Security Review is a false postive. There is no malicious alteration.

Your issue is a known bug with Security Review that has already been raised in the module's issue queue at Drupal.org. There is a also a patch that is supposed to fix this issue in the module's issue queue.

You may help the community by applying and reviewing this patch.