I’ve found that Avast (free AV) erroneously removes hosts file entries (IMHO).
I accept that avast may want to remove host file entries that try to block access to genuine avast domains, but it seems that avast is removing anything that ends in avast.com regardless of what precedes avast.com.
For example all of the following are removed within moments of them being added:
127.0.0.1 www . download-avast.com
127.0.0.1 download-avast.com
127.0.0.1 telecharger-avast.com
127.0.0.1 www . telecharger-avast.com
Note spaces added in those with www . so as to avoid being treated as active links (as these sites might be dangerous)