Hi!
I am experienced system administrator, with 15+ years of experience. I have been contracting a lot lately for a local hosting/cloud services provider.
I've seen this exact malware problem before, but fixing it can take up to a weak, for the IP to be cleared. Firstly the abusing web page, oe more of them, needs to be pin-pointed, so if there is lots of pages on the server, procedure can take some time. After the abuse is stopped, it can take up to few days for the blacklisting services to clear the IP.
Best regards
Tic Pavlin