Since my last post about the ASP.NET development server mysteriously not working it seems that Microsoft and several security firms have confirmed that the issue was definitely caused by Windows Defender and due to one of its definition updates that went out on Monday evening (9th March).

Read about it on CNET.

Windows Defender mistakenly raised the Win32/PossibleHostsFileHijack alarm deleting the crucial mapping between localhost and 127.0.0.1.  DOH!

I got to work today and was unable to connect to any web sites using the built in ASP.NET Development Server.  In Internet Explorer I got the following message: "Internet Explorer cannot display the webpage" and in Firefox the message was "Failed to Connect" and "The connection was refused when attempting to contact localhost:3503".

This was strange, I had no problems yesterday, and no updates to .NET or Visual Studio had been installed on my machine overnight. Looking at windows update history, the only thing that had changed was an update to the Windows Defender definition file. Surely that can't be the problem, I thought. After a long time scratching my head, it appears that the problem was indeed Windows Defender and on further investigation I found this in my Windows Defender history:

So it appears that last night, Windows Defender removed this line from my hosts file (C:\Windows\System32\drivers\etc):

127.0.0.1    localhost

and either added or left behind the following line:

::1    localhost

Windows Defender has "defended" me from developing on my local machine, because localhost isnæt mapped correctly. To fix this problem, adding the first example (above) back into my hosts file and removing the second example fixed the problem.

I wonder how many other developers this affected?