when google updates its cache, if it finds files that are virus/malware it flags the domain. Its not reports from users AFAIK. The domain stays flagged until the domain owner submits to google the malware is removed. Google then rescan it at some point and remove the flag if everything is ok. (as stated above, I have been through this process a few times.)