The “virus” will create the following files if not found in the web folder: index.html, index.htm, default.html and default.htm.
So, if you IIS doesn’t have the “real” home page as the first item in the “documents” (for example, you have index.html, but you have index.htm as the first item), then the home page will be replaced.