He doesn't have MSE installed, by any chance, do you?
I don't have MSE installed, in fact, I don't have any additional AV, but "Windows Defender" insists on telling me that I have some sort of "Win32/HostsModifier" virus or whatnot, when in fact, it's just that I edited the hosts file manually, and added some entries.
It keeps prompting me to disinfect, but I ignore it, knowing that my hosts file is fine.
I wonder, is it possible that WD prompted, and your dad "disinfected" the file?