It seems to me that this was a very rare situation! As you stated, TSM would
not have changed the extension on the file from .exe to .avb, that was the
anti-virus software or virus itself. Since this file did not change in 33
days this was the only file, which was **ACTIVE** since Nov. 29th, 2001.
Thirty-three days passed by WITHOUT the file changing (Dec 31st, 2001).

So, if this file is changed any point after Dec 31st, it will become
INACTIVE & be flagged for expiration after the next incremental backup. If
expiration has already been run (typically it has if it runs daily) the now
INACTIVE copy hqb.exe will drop off and this file (corrupted) hqb.avb will
be ACTIVE for 33 days (beginning March 2nd,2002) until it is changed!


The only thing that could've gotten you out of this situation was a longer
"Retain Extra Versions"!

Only my thoughts!!!!!

Regards,

Demetrius Malbrough
UNIX/TSM Administrator