One of our clients got his website infected almost a year ago. The site indeed contained some malicious files on the FTP server, and it got marked as dangerous, with suspicion of phishing attempts.
A couple of weeks ago we finished a brand new website for this client (there is not a single file remaining from the previous website and the database is all-new as well. The site is 100% clean.
After migrating the site to the live domain, we noticed it won't show up correctly. We were getting various errors (phishing related). I checked the Google Transparency Reports and noticed the site was marked as dangerous. I requested a security-check via Google Search Console, they reviewed the site and removed it from the database. It started working well immediately (this was a couple of weeks ago).
However, after this I noticed the site still won't load on machines with third-party antivirus and antimalware software installed. For example ESET. I reported the site as false-positive at ESET, it took them quite a few days to review it but they managed to remove it from the database.
However, I noticed the same thing for many other antimalware software - e.g. Malwarebytes, AVG, etc. I contacted the support in a few cases, but no response yet.
Another problem is: It is just one step to remove the site from the database of dangerous websites - there is always a client who needs to update his database (correct me if I am wrong).
Considering there are dozens of antivirus software solutions (not all of them have good support as Google or ESET) - is there actually a working solution for this problem, better than investing hours in talking to lots of supports? Many antivirus software won't even let you ignore the phishing warning, so unless you know how to set exceptions, you won't get to the site at all. This is really a bad scenario, considering it is an eCommerce website.