I just went through this on one of my personal sites...getting the AVG warning box. Found malicious code was put on 2 blogs and one domain via a search by the host.
Spent the day upgrading all my WordPress installs, changing passwords, secret code, etc. then notifying Google via Webtools that the domains were now ok. Fortunately, there is no warning box this morning.
Does this sponsor have rss feeds for blogs? If so, there is some kind of vulnerability in WP and if they don't keep the blogs updated, they can get in and drop code on not only the blogs, but other domains.
It looks like that was the case with me, as I had one blog that was running a really old version of WP, shame on me for not upgrading, and that had the code on it.
Good luck to them it is
getting that straightened out.