The following system changes may indicate the presence of this malware:
The presence of the following files: %AppData%\wintemp\csrss.exe
The following lines have been added to your Hosts file: 127.0.0.1 www.virustotal.com 127.0.0.1 http://virusscan.jotti.org/de
PWS:Win32/Sacanph.A is a trojan that steals URL history and user information from certain applications. It also modifies the Hosts file to prevent access to certain websites.
What to do now
To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat: