For spam with a malicious link, flag as spam and edit out the link (and vote to delete if you can). Usually I'm against editing spam posts, but if it is a likely malicious link it certainly makes sense. The spam flag is important as it auto-deletes after 6 flags.
For a legitimate user just remove the link and comment, there is likely no need to delete the post.