My NT 4 proxy server has the W32.Rahack.H virus. When I scan it quarantines anything it finds then 4 hours later it warns me again with an email saying it was back. Any help would be much appreciated.

I did 2 logs, the first before I cleaned up a few items is below. Where you see "Mydomain" I removed sustituted that in for my real domain here at work.
This is a proxy server running on NT 4. Its old but it worked for years. We are about to move to a new setup but we need this running for a few more weeks
The computer name is Cronus. Its also runing arcserve for backup, and net.medic which doesnt have to be running. Its a DNS server too.
*** is where I removed already some items.

About 4 times a day I get this in my email letting me know there's still an issue. I run Norton antivirus and it will do a scan and find nothing after I clear the quarantine.

Alert: Virus Found
Computer: CRONUS
Date: 11/27/2006
Time: 10:45:40 AM
Severity: Critical
Source: Symantec AntiVirus Corporate Edition
C:\WINNT\system32\.exe
SYSTEM
W32.Rahack.H
Clean




Logfile of HijackThis v1.99.1
Scan saved at 10:20:54 AM, on 11/27/06
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\spoolss.exe
C:\WINNT\system32\RpcSs.exe
C:\WINNT\System32\msdtc.exe
d:\ARCSERVE\dbeng.exe
C:\WINNT\System32\nddeagnt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\comsmd.exe
C:\WINNT\System32\DACONFIG.EXE
C:\WINNT\System32\loadwc.exe
D:\PROGRA~1\NavNT\vptray.exe
D:\Program Files\VitalSigns\Net.Medic\Program\netMedic.exe
D:\Program Files\VitalSigns\Net.Medic\Program\syshook.exe
d:\ARCSERVE\jobeng.exe
d:\ARCSERVE\RDS.EXE
d:\ARCSERVE\msgeng.exe
d:\ARCSERVE\tapeeng.exe
C:\WINNT\System32\cisvc.exe
D:\DBAGENT\DBASVR.EXE
C:\WINNT\System32\dns.exe
C:\WINNT\System32\drmon\smartagt\smartagt.exe
C:\WINNT\System32\cba\pds.exe
C:\WINNT\System32\llssrv.exe
D:\msp\mspadmin.exe
D:\PROGRA~1\NavNT\Rtvscan.exe
C:\WINNT\System32\pstores.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\winmgmt.exe
D:\msp\wspsrv.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
D:\msp\mailalrt.exe
C:\WINNT\System32\LOCATOR.EXE
C:\WINNT\system32\tapisrv.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\system32\mmc.exe
C:\WINNT\System32\cmd.exe
D:\PROGRA~1\NavNT\vpc32.exe
C:\WINNT\Profiles\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mydomain.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = cronus:80
F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [COMSMDEXE] comsmd.exe -on
O4 - HKLM\..\Run: [DACONFIGEXE] DACONFIG.EXE R
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\NavNT\vptray.exe
O4 - Global Startup: Net.Medic.lnk = D:\Program Files\VitalSigns\Net.Medic\Program\netMedic.exe
*** O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
*** O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O13 - WWW. Prefix: http://
*** O16 - DPF: Yahoo! PagerLite - http://jpager.yahoo.com/jpager/y/pg5_x.cab
*** O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (WficaCtl Object) - http://midas/ica/bin/cab/wfica.cab
*** O16 - DPF: {8BD21D30-EC42-11CE-9E0D-00AA006002F3} (Microsoft Forms 2.0 ComboBox) - http://sadim/filenetSample/download/mspert10.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Mydomain.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Mydomain.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 10.1.1.15 10.1.1.17
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 10.1.1.15 10.1.1.17
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: ARCserve Database Engine (ASDBEngine) - Unknown owner - d:\ARCSERVE\dbeng.exe
O23 - Service: Cheyenne Discovery Service (ASDiscoverySvc) - Unknown owner - C:\WINNT\System32\ASDscSvc.exe
O23 - Service: ARCserve Job Engine (ASJobEngine) - Unknown owner - d:\ARCSERVE\jobeng.exe
O23 - Service: ARCserve Message Engine (ASMsgEngine) - Unknown owner - d:\ARCSERVE\msgeng.exe
O23 - Service: ARCserve Tape Engine (ASTapeEngine) - Unknown owner - d:\ARCSERVE\tapeeng.exe
O23 - Service: pcANYWHERE Host Service (awhost32) - Symantec Corporation - C:\Program Files\pcANYWHERE\awhost32.exe
O23 - Service: Cheyenne Alert Notification Server - Cheyenne Division Of Computer Associates International, Inc. - d:\ALERT\alert.exe
O23 - Service: DBagent RPC Server (DbaRpcService) - Unknown owner - D:\DBAGENT\DBASVR.EXE
O23 - Service: DefWatch - Symantec Corporation - D:\PROGRA~1\NavNT\DefWatch.exe
O23 - Service: 3Com dRMON SmartAgent PC Software (dRMON SmartAgent) - 3Com Corp. - C:\WINNT\System32\drmon\smartagt\smartagt.exe
O23 - Service: Intel Alert Handler - Intel Corporation - C:\WINNT\system32\ams_ii\hndlrsvc.exe
O23 - Service: Intel Alert Originator - Intel Corporation - C:\WINNT\system32\ams_ii\iao.exe
O23 - Service: Intel File Transfer - Intel Corporation - C:\WINNT\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel Corporation - C:\WINNT\System32\cba\pds.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\PROGRA~1\NavNT\Rtvscan.exe
*** O23 - Service: nSecure - Unknown owner - C:\WINNT\System32\nSecure.exe (file missing)
O23 - Service: Web Connect - Unknown owner - C:\Program Files\StarTeam VirtualTeam Server 4.0\Web Connect\WebConnect.EXE