I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure.
To my understanding, "secure" here refers to "immune to MITM attacks", but since such websites have certificates and such, is it right to assume they are "clean" and non-malicious?
No, HTTPS does not necessarily mean that a site is not malicious. HTTPS means very little as to the security of a site. It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself.
Yes, a site serving content over HTTPS has a certificate. That means that the individual who requested the certificate from the CA has an email address that is associated with the domain. Except in the case of Extended Validation certificates (the ones that offer a green address bar) this is literally all it means. Nobody from the CA is validating that the site is safe, secure, and not serving malware. Any site, with an SSL cert or without, can have bugs and vulnerabilities that allow an attacker to leverage them to serve an exploit. Or a admin or user who has the ability to either maliciously or unknowingly cause the site to serve malware. Even if the site itself does not, if it serves advertisements (or any other content, for that matter) from an ad network or another site, that could be vulnerable.
So, HTTPS means that nobody should be able to view or tamper with your traffic. That is all that it means.
Not at all a guarantee. HTTPS means that the web page has SSL, which simply means that your connection to the page is encrypted. The content on the page could be anything that could be posted on any web site whether encrypted by SSL or not.
Additionally, as listed in the answers in the comments below, you can be fooled into a false sense of security when (in different types of examples) the target server is compromised, or a hacker redirects your https site data to a different https encrypted location. You can still be encrypted to a site, but possibly even a fake site that looks like the real one instead.
In short: Yes, it can indeed be malicious!
Accessing a site via HTTPS means that the connection between your computer and the website's server is encrypted and secure.
What HTTPS does
What HTTPS does not do
Therefore its still possible for the website's authors (or someone who has gained unauthorized access to the website) to have the website itself serve malicious content to your browser.
The secure from https isn't related to content on a website/service.
It is called 'secure' because theoretically the security protocols (ssl/tsl and some others) do not allow the information being exchanged to be easily understood (it encrypts the data flow), so, even if someone would catch your packets, they would have to decrypt it to understand the message.
Now this is useful because some information such as passwords, social security number, credit card number and etc. can cause a lot of problems if they are discovered by someone intent on causing damage.
In this sense, https helps us by making difficult for a third party to know what information we exchanged with a website (and that's why most banks do utilize at least https on their services), but that doesn't stop a website or service to be infected with malicious software or an attacker to indirectly reach you by infecting a server.
Now, I inferred from your question that when you used the term 'secure' you meant it in different way (in the sense of safety against malicious content), in this sense, https does not protect you at all because it doesn't pay attention to content (what is being transmitted through the connection) itself.
Yes, it can easily be - malicious JavaScript or viruses can be transferred over HTTPS as easily as over HTTP no problem. It may be somewhat less likely as the source of the valid verified HTTPS message is known.
However still may happen if the HTTPS site has had security hole, has been attacked, compromised and malicious content has been installed on it. It will not be for long, soon the administrator know one or another way and remove the malware. However I would prefer to avoid trusting the content just because it was delivered over HTTPS.
Add to the list that the CA itself could have been hacked (e.g. DigiNotar) and used to issue fake certificates, or your browser might be forced to use fake CAs specifically so that your connection might be intercepted and tampered with - as is sometimes used on corporate networks.
Oh, also the certificate might have been faked because it was using MD5. As has been already said, that lock icon in your browser means something else than you think it does :).
In addition to the other points raised, it's worth mentioning that even a trusted site (for example, your bank), could still be infected by a virus that makes it behave maliciously. So even if you trust the organization, https still does not guarantee that the website doesn't do malicious things.
All an authenticated HTTPS connection does is validate that if https://www.example.com is shown in the address bar, that you are in fact connected to www.example.com.
The certificate does not certify that www.example.com is not malicious in any way. An Extended Validation Certificate with a green highlight shown around the address bar will allow you to know the actual organisation behind the site, so if you trust them you can trust the website. There are also Organisation Verified certificates, however it is hard for regular users to distinguish these from Domain Verified certificates.
DV certs are very easy to get hold of - so unless you know and trust the domain of the site already, you should not afford any additional trust in the site just because it uses https.
A Pharming attack can be used to redirect your traffic to a malicious server. This server will connect to the legit one and will authenticate on it as if it is you. Then it will present to you the information or web page from the legit server. For you - it will appear as you are connected securely to the legit server but now there is a MITM that has access to the channel and he can read everything on it. This kind of attack is difficult to execute but it can render HTTPS useless...
So the site dose not have to be malicious, it can be your bank. But, using this approach, some one can get all of your account data, credentials, etc even though the site is HTTPS.
Also one thing to consider very carefully, is that certain antiviruses work by scanning the traffic. If the site is using HTTPS, a virus can in fact slip undetected past the radar.
This is especially important if you either have a antivirus service provided by your ISP, your employer, or your school, which is based on a "Proxy". This is why some proxies actually pretend to be MITMs like BlueCoat Proxy, and then unpack the encrypted traffic, read it, and then send it along with a spoofed certificate (which all client computers behind this Proxy is configured to accept, either via a GPO or by a NAC device).
Thus, HTTPS is a double edged sword. It can be used by the good guys to hide good data (credit card numbers, passwords etc) from the bad guys (eg scammers, hackers). But it can also be used by the bad guys to hide bad data (eg viruses, illegal files etc) from the good guys (virus scanners, law enforcement etc)
So in the "virus protection parlance", you should AVOID using HTTPS.
I also know that HTTPS websites are secure.Not quite. HTTPS connections are secure. That says nothing at all about the website on the other side of the connection.