Possible Sythe Account Hacker (Again)

Link to scammer's Sythe profile: http://sythe.org/member.php?u=296753
Briefly explain the trade: His signature has a rendered GIF (which is meant to look like a virus probably to hide the fact is is) that is reported by my anti-virus. (PLEASE READ ON BEFORE THINKING I'M AN IDIOT)
How they scammed:

PHP:

<div align="center"><a href="http://sythe.org/showthread.php?p=8773852" target="_blank"><font color="lime">Vouches (1).</font></a><br />
<img src="http://upit.cc/images/8c4c4271.gif" border="0" alt="" /><br />
<b><font color="yellow">MSN:</font></b> <font color="orange">for.sythe.trades@gmail.com.</font><br />
</div> 

NOTE: This thread was closed prior because

I'm not saying it's from my anti-virus program. When I navigate to that picture my anti-virus intercepts it and reports it as a virus:


I believe it's a GIF driveby attempt. Basically an attempt to steal information from your browser when your browser renders that file.
Don't just close this thread please, ask another moderators view on it, I'm sure one of them will agree.

When I use VirusTotal to view it:


And when you analyse the file you see it's not infact a GIF, but "text/plain", basically code that makes itself render an image, yet the code still executes:


I have no idea what the code does, but again, my anti-virus says it's malicious.
If you close it this time, I won't re-open it. But I hope you look into it.

 

Removed it, he readds it I will just ban him