Windows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well.

It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file. The same would be true for any automated anti-spyware tool.

So yes, this looks like it would only affect a very limited number of people - technical enough to check the hosts file, but naive enough to do it manually and not notice the other hidden file.

Since Windows by default don't show hidden files, I must say that most of my engineer coleagues would fall in the trick. Sadly, most people that I worked open the files manually.

I find that disturbing, one of the first things I do after a clean install of windows is to check the "Show Hidden Files", which was hard to find in Windows 7 :/ I thought most tech savvie people did that?

I wonder why you say it was hard to find - it's always been under the View tab in Folder Options.

Maybe because of the Control Panel revamp, or the fact that the menu-bar is hidden by default in Explorer windows?

I've been using Windows 7 at work for about a year, and I had absolutely no idea that the menu will show up when I hit the alt key until exactly 2 days ago. Every time I needed something from it I'd just rummage around all the visible menus, not find it, curse my head off and open up the command prompt.

I'm not sure which will look dumber as a consequence of this post: me or the Windows 7 UI.

Don't feel too bad. I've been using Windows 7 since shortly after it came out and I had no idea until I just read your post.

It's due to the hidden menu, same drill with Office 2010 and finding "Save As.." etc, I've never been much for just using the keyboard, I like using the mouse to navigate the menus ;)

I don't. I generally leave that off, especially on my mac. If I want to see hidden files, I launch a terminal and list all files.

How is the real hosts file rendered hidden in Explorer?

Like any other hidden file, it's not rendered until you choose to show hidden files and then at the point, it shows the file, but the icon is semi transparent.

Sorry, I meant how do you make a file hidden?

     attrib +h

at the cmd prompt, the file properties in explorer would have a checkbox for this too

The hosts file is very important to windows because it maps domains to ips. So I could actually point google.com in my hosts and send myself to the ip of yahoo.com. The key observation here is that the REAL hosts file was hidden, and a hosts file that only looked like a hosts file (with a different kind of o) was the non hidden one.

The operating system sees the hosts file as normal. A person trying to debug it through the gui (with hidden files hidden) sees the dummy hOsts file and thinks that's not where the problem is.