OK, if your site was passing as clean BEFORE and then gets flagged as "unclean" by Google AFTER you added that 1x1 iframe pointing to your guy's site then the inescapable conclusion is that HIS site is the one with malware trouble, and warrants, for sure, a discussion with him before you go any further. It could be a case of Google being an overprotective net nanny about something "borderline" on the site, or something legitimately dangerous and Just Not Cool (TM).
If it is a legit threat lurking on his site, well, Napoleon did say never attribute to malice what one could easily also attribute to ignorance. Your mileage may vary though in this regard, but you really do owe it to yourself to find out what the deal is by discussing it with him before you continue any further.
In the best case, he will be grateful you caught something he missed, it will get taken care of and then you can continue to plan out how exactly it is that you will be driving "traffic" to his site (but seriously, that phrase is so vague, it could mean like literally a hundred different things depending on who you are talking to, so it would help to ask him to clarify what he is expecting, at least in general). In the worst case, you may have uncovered more about what his operation is all about than he was interested in disclosing to you (upfront anyway), and you will have to think long and hard as to whether or not this is someone with whom you actually want to pursue business dealings (I would advise against, personally, but that is the choice I have made for myself about the kinds of people I wish to do business with, after MUCH past life experience, most of which was less than amicable).