I didn't shutdown my pc last night and I left procmon running to monitor WriteFile operations on hosts file.
This morning when I work up, I saw this result:
and what is changed in hosts is that the entry containing "www.google.com" is gone! I'm pretty sure about that because I checked the content of hosts yesterday before I slept. Just now this morning, I checked hosts again, the entry with "wwww.google.com" is gone while everything else is untouched.
Could anybody explain what happened ?