Ok, here it is…
Nimda virus infected a server and 5 workstations. Fixnimda tools were downloaded and run on all machines. Hubs were powered down and internet disconnected while Virus removal tools ran. After informing us of SUCCESSFUL virus removal on all machines, it was run again and found to be not infected with the Nimda. All ZIP disks, CDs, floppies and tapes were scanned and found clean. Network was brought back up and the next day the Nimda is found on all machines again. Internet access was setup 2 days ago and no e-mail has been assigned as of yet. We are certain that it is not coming in from the internet or from the outside world. We are certain that it isn’t being loaded on by an angry employee or somthing like that. We have used several different nimda removal tools with similar results. Am I missing something? Anyone have any idea what is going on?