A scanner app with 100 million downloads starts to deliver malware