Long suspicious script
This is liveinternet.ru counter. Same FP reaction on some sites where it is installed.
from norma-market.ru
<!--LiveInternet counter-->
<script type="text/javascript">document.write("<a href='
http://www.liveinternet.ru/click' target=_blank><img src='//counter.yadro.ru/hit?t14.6;r" + escape(document.referrer) + ((typeof(screen)=="undefined")?"":";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth?screen.colorDepth:screen.pixelDepth)) + ";u" + escape(document.URL) + ";" + Math.random() + "' border=0 width=88 height=31 alt='' title='LiveInternet: показано число просмотров за 24 часа, посетителей за 24 часа и за сегодня'><\/a>")</script><!--/LiveInternet-->
new code from liveinternet.ru
<!--LiveInternet counter-->
<script type="text/javascript">document.write("<a href='
http://www.liveinternet.ru/click' target=_blank><img src='//counter.yadro.ru/hit?t14.6;r" + escape(document.referrer) + ((typeof(screen)=="undefined")?"":";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth?screen.colorDepth:screen.pixelDepth)) + ";u" + escape(document.URL) + ";" + Math.random() + "' border=0 width=88 height=31 alt='' title='LiveInternet: показано число просмотров за 24 часа, посетителей за 24 часа и за сегодня'><\/a>")</script><!--/LiveInternet-->
http://www.finjan.com/Content.aspx?id=1190&url=http%3A%2F%2Fnorma-market.ru%2F&state=unsafe&category=Other&reason=Potential%20adware%20behavior%20was%20detected%20on%20this%20page&more=
Possible that reason is same.