Well, was this any problem at all? If the adsubstract alias for the 127.0.0.1 IP would not be in the host file, the word "adsubstract" would be simply changed to "localhost" and that's all. On the screenshot you simply see that "Avast! Mail Scanner" has some connections with the local endpoint on your computer (that is: 127.0.0.1, also known as localhost, by your HOSTS file also known as adsubstract). There is nothing suspicious on this fact!