Your saying that you have formatted and your still compromised ?. It's a webserver ? there could be a ASP backdoor in one of the sites. If not one of your back up files is hinding something more...