[BareNakedCoder]

UPDATE: For anyone else running into this problem. Of course, Google never clearly stated this reason, I (and you) have to guess until you get it right. Each guess takes more and more time. My last (and successful) attempt, I had to wait 16 hours for Google to do its review and unblock our site.

Turns out sites are guilty by association. If Google finds malware on "old.chess.ca" it will bock every website ending in "chess.ca". Including "www.chess.ca" even though that website is on different servers (different IP) and contains zero links to the other bad website. Removing the server from DNS, plus disabling with .htaccess rules that redirect all requests, ... plus waiting 16 hours for Google to do another review ... is what got us back up & running.