Before you try scrubbing your server again I would recommend throughly checking your workstations.

Nimda is not a server-only worm like some of it's predecessors, which took advantage of the same IIS vulnerabilities.  There is a potent workstation component that spreads via email, network shares and infected web sites.

If you have an infected desktop that accesses your server it could be dropping and/or modifying files on your server.

here Network associates blurb on it:
http://vil.nai.com/vil/virusSummary.asp?virus_k=99209



Peter Chin
Network Administrator

Office of the Controller
Michigan State University
146 Administration Building
East Lansing, MI 48824

Ph. (517) 353-4443
Fx. (517) 353-1046