I have no answer for the time it takes to recover back to former days but at least advice you to check even more then just @google. Reason could be that google
says "your clean" but others could say you aint and that could be in some situations even more important.
After a bad experience with one of our mailservers we found out that it is important to check and double check to be sure all was good again afterwards.
Because our server bounced mail back we could react fast but it still took 2 days with lots of #%#%$ but we where "lucky" to have "only" a little mail problem afterwards.
Below I have a little list with sites which offer you checks (FCrDns & DNSBL and more) for free, you can never be sure enough.
Do they show that your site is not Blacklisted then the least you could do is contact Google and explain the how and what, and also what you did to solve that
malicious code issue. You never know if they can(or willing) to help you, but asking is for free.
1) This one checks your IPv4 and shows outcome data.
2) LHSBL and RHSBL check for free.
3) Another good one (E-mail checking)
4) Realtime blacklist, DNSBL or RBL
5) Blacklist Checks (80 DNS-based anti-spam databases)
6) Malware Scanner
And maybe this link to Google Webmaster Central Blog could help you also a little more.
I hope you find the cause and a solution for your problem.