Given that we've been hacked twice before, and having gotten this: Hey Vicky, might be time to turn of avatars for a little bit. Just FYI, I tested this and it works.

from jab, I'm going to turn off the avatars until SMF releases a fix (which shouldn't be long).

Sorry for the inconvenience, but I'd rather not comprimise our db (I figure you'll agree).