First: I can't find any information on this phenomenon, not anywhere on the net.
I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) updates my hosts file. I have UAC enabled. To edit my hosts file, I have to run Notepad with admin privileges or else I can't save my file.
127.0.0.1 ad.doubleclick.net has disappeared several times now. It looks like that is the only line to which this happens. I have other lines in the same file, and they are left untouched.
I suspect Google Chrome to be responsible for this, since the Google Updater probably has the permissions to modify system files - and it's in their interest to load their crap, but I am not sure. While I understand that I use their services and that ads pay for those services, I don't like the idea of software violating my system like that. And I am surprised that it's even possible, I thought Chrome installed within the user profile and didn't need system write access to install.
Can anyone else confirm this issue? Any experience with similar things happening to the hosts file?
Edit: I have ProcessMonitor running with a filter on the hosts file. Let's see what I can find... thanks for the suggestion, I hadn't thought of it initially.
Update: This morning, Process Monitor showed a bunch of file activity. And 127.0.0.1 ad.doubleclick.net is gone! It looks like Windows Defender did it. Read the Process Monitor log here: http://pastebin.com/eJTf5qWs