Yep, I'll agree with that. I've not used SpyBot, so I wasn't aware it directed blacklisted sites to localhost, but that makes sense.
Certainly, as you say, anything nasty will be obvious, such as a lot of lines similar to:
Code:
www.google.co.uk www.trojangoogle.com
www.google.com www.trojangoogle.com