I can't do it that way now either, but I'm using Windows 7.
When you changed the name of the existing HOSTS to HOSTS.bad, did you try a reboot, (restart the computer), to see if XP re-creates the file?
If so and it doesn't, try this.
In that folder, (the folder where HOSTS should be), right click any empty part of the folder and select New > Text document, (it may be Text file in XP). A new blank Txt file should be created with its name highlighted waiting for you to rename it. Name it HOSTS and delete the .txt extension, then press Enter. Windows will warn you about the change but just accept that.
Now, open that file, add anything in that you need to add, (like the blank HOSTS file always has), then File > Save. (Not Save as, I think that is where I misled you and I apologise for that).
Some questions for you;
1] Where are we now? You mention that various malware threats have been removed, but are they recurring?
2] What about the browsers, what situation are they in?