Comment: It's possible someone may

It's possible someone may have injected malicious code onto the website, and then immediately reported it to google so they'd blacklist the website. Even though Google reports that no malicious software was downloaded to any visitors - it doesn't mean it doesn't exist on the server. Some scripts are set up only to "spy" on website activity / visitors and send that information elsewhere.

Either way the websmaster (Michael Nystrom) is the only one who can fix it... I'd advise:

1) Searching for the malicious code first. You can do a mass search for script tags and look for snippets you don't recognize. Or you can simply sort and compare by the last modified dates and see if any files were modified that you know you didn't touch.

2) Remove any malicious code found, and try to find out how it made its way onto the server. The server logs are often very useful for giving you extra information on suspicious activity. You can also beef up the overall security of the Drupal CMS in general (it runs on PHP right? If so check out www.phpfreaks.com/tutorial/php-security)

3) Now you can go into google's developer tools and request a review of your website.

Sorry for the long ramble I'm a web developer and tend to get overly excited about this stuff :)