It is a valid gif or jpeg file so detecting the header won't work. Our software kills them on both the upload level, and also can detect the client most of them use for download. They just found a way around our system recently and we had it corrected the next day. So it can be done, except our software is only for our hosting clients
