ATTRIB with just the name of the file or folder can tell us what attributes are set. This is how the HOSTS file was set because the malware automatically inserted its own entries for common sites like For the average user, these settings means that even if they knew exactly where to navigate to, they wouldn't have been able to fix the file. The following image shows that the hidden checkbox is grayed out when both of these attributes are set: In that particular case you can't make the file visible again, nor can you change it from being a system file without the use of ATTRIB. When cleaning up some malware from another person's desktop yesterday, I ran into this.

One of the few cases where you would have to resort to ATTRIB is if the file is marked as a system folder. We don't use it too much any more because the Windows GUI tends to allow us to manage the A, H, and R attributes just fine.

S - Whether or not the file/folder is treated as a system object.

R - Whether or not the file/folder is read-only.

H - Whether or not the file/folder is hidden.

A - Whether or not the archive attribute is set (this can tell a backup process if the file has changed since the last backup).

There are 4 attributes which it can manage: The purpose of the command, as its name implies, is to manage the attributes of files and folders. ATTRIB is one of those commands back from the days of DOS which most folks don't even realize it's there.

Attrib not resetting system file