Some operating systems, including Windows, want to enforce verifications of signatures of DLL. The verification entails validating the signature against the signer's public key, which is found in the signer's certificate, which itself needs to be validated. Certificate validation includes revocation status check.
In practice, a Windows OS validating a certificate will download CRL to ascertain that the certificate is not revoked. However, if the same OS cannot download the CRL, then it will just assume that the certificate is probably unrevoked. According to the normal X.509 model, when revocation status cannot be obtained, the certificate should be rejected. However, this means here that the application does not start, and the consumer will be unhappy (that is, significantly unhappier than what is already entailed by using Windows); and it would mean that the machine cannot work without a working Internet connection, which would imply some interesting chicken-and-egg issues.
So adding an entry which prevents connections to Verisign's CRL download server can have a malicious reason: this allows the attacker to sign his nefarious code with a revoked certificate (e.g. a certificate whose private key has been stolen by the attacker some time ago), while still maintaining a working Internet connection for the said machine.