I have completed successfully many projects like yours, we have to identify the backdoors, or malware that`s present in your website directories, find the security hole, delete the malicious files and fix the problem. Then we can reply to google that the website doesn`t contain malware anymore and you`ll get out of the blacklist. All in a day. I`m administrating over 200 servers, maitaining their security, and these problems is very common for me.