well nihil mentioned this:
and what I seem to recall are called "datastreams"...........sort of stuff hidden in the background of NTFS?
I have seen this in action. Its called Alternate Data Stream or ADS, a few number of malware use it, so far i only bumped into 2 of them. Its a pain in the arse to detect/notice, unless u know what to look for. Anyway, I dont think i can properly explain how this works but I can give you this link as a reference.

http://www.windowsecurity.com/articl...a_Streams.html