"Aha! I don't recall seeing 'cricamarvin' but blig.ig.com is the URL that kept hijacking my browser."
Yes it does. I just checked 'History' and http://blig.ig.com/index appears there. (hadn't thought to check it before) The malware my be inherent to that site and not part of James54's hack but he brought it here so the intention is the same AFAIC.
The prefix to that URL 'cricamarvin', which is part of the URL the JPG comes from, may indicate his personal connection to that site. More internet savvy FReepers might know the significance of that.