> 1. I opened a tab to http://thecatalogfree.net with Firefox 3.0 on WinXP
....
> 127.0.0.1 thecatalogfree.net
> 7. I then shift-reload my browser (to flush cache)
> 8. Voila! A shift-reload flushes cache & dumps the kwiksand page!

I tried this without shift reloading and the kwiksand page still locks up
the browser infinately.

So, the kwiksand page must NOT be looking at the hosts file after the first
reload which means it must be looking only in your cache which means it
must have already dumped its malicious code in your cache from the start.

Only shift reloading the browser after putting the quicksand page into the
hosts file will solve the problem.