The trojan horse is within the animation code for the GIF, regardless of whether it's uploaded or linked to an outside source. I've always had remote linking disabled. Here's what the code looks like in pokerfan's former animated avatar:




The specialist suggested we disable avatars completely if we want this to be foolproof (as far as image viruses go). But that's a bit extreme. We're considering the possibility of having all avatar uploads screened before the images are saved. That may be the best option, if it's possible to do without slowing down the server.