Instead of Filemon I&#x27;d suggest firing up Process Monitor [1] with a filter of &quot;path contains system32\drivers\etc\hosts&quot; and then Filter -&gt; Drop Filtered Events.<p>Let this run while you go about your normal work, then check back after you notice the change. Look through the Operation column for WriteFile or something similar, then see what Process Name did it. This&#x27;ll let you figure out what&#x27;s actually making the change and you can appropriately assign blame.<p>[1] <a href="https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;sysinternals&#x2F;processmonitor.aspx" rel="nofollow">https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;sysinternals&#x2F;processmoni...</a>