So google is aware of the markmonitor site abuse: http://www.google.com/safebrowsing/diagnostic?site=googleusercontent.com/
See the malcode on googleapis dot com: https://www.virustotal.com/en/domain/googleapis.com/information/
Avast detects: Win32:Fareit-HE [Trj] - which also easily could be a FP.
polonus
