On Windows, Microsoft Security Essentials warns when a hosts file change is detected. Fortunately it's a simple click to decline any further action. Related, I've witnessed AdBlock Plus spontaneously removed from Firefox, I assume due to anti-virus software, but possibly also due to MSE.