[Michael]

I came across yet another fake PornTube site.



The Whois for that domain is somewhat obscure!



The malicious file comes from another domain (eshymkent.cn), yet on the same IP



The malware file turns out to be a rogue app called Fast Antivirus 2009



Although this rogue is already known, I am surprised to see the low detection rate on VirusTotal:



Jerome Segura

Malware ID:*d33e766d7fc6a984fe797816cc4af245.zip