I flagged an obvious spammer whose site was blacklisted by google for malware. Its straightforward since it is spam on the other hand What would be the proper action if a legitimate user posts a link, and its unwittingly malware?

Flag it? Edit it? Comment that its malware and leave it as is?