I believe Google provides the reason(s) why a site is listed as an attack site. However, I don't think they're very detailed (I guess they don't want malware writers/purveyors to know how they detect attack sites), so I would dive into your server logs and see if there are any unknown entries or suspicious patterns.
Alternately, you can use diff (or other directory/file comparison tools) to compare your local/development copy of the site with what's on the production server. That should show you any added files or code that weren't put there by you. A version control system can also do this very efficiently.
If you're not computer-savvy enough to figure out where the malware is located (don't feel too bad; they're specifically designed to evade detection), then try asking your web host for help.
Or, if you make regular backups, you could just wipe everything clean and roll your site back to the last known "clean" date (and then manually re-add lost content, if necessary).
But as soon as you get all of this done, be sure to update all of your web apps to the latest versions and change all your passwords (CMS, ftp, shell, cpanel, even email).