Win32/Agent.WJ [Threat Name] go to Threat

Win32/Agent.WJ [Threat Variant Name]

Category trojan
Aliases Trojan.Win32.Agent.wj (Kaspersky)
  W32/USBToy.virus (McAfee)
Short description

Win32/Agent.WJ is a trojan that spreads via removable media.


When executed the trojan copies itself in the following locations:

  • c:\­windows\­system32\­mslogon.exe
  • %userprofile%\­Start Menu\­Programs\­Startup\­systemnt.exe

This causes the trojan to be executed on every system start.


The trojan copies itself into the root folders of removable drives using the following name:

  • Toy.exe

The following file is created in the same folders:

  • AutoRun.inf

Thus, the trojan ensures it is started each time infected media is inserted into the computer.

Other information

The trojan may display the following messages:

  • PS: can you find the program's interface ?
  • History Must Be Remeber !
  • God said: Let there be light. And there was light.
  • And darkness was upon the face of the deep.
  • And the earth was without form, and void.
  • In the beginning God created the heaven and the earth.
  • In Memory Of C8C

The trojan contains the following strings:

  • USB TOY 2.0
  • This program is not a virus , just a Microphone for me ...

Please enable Javascript to ensure correct displaying of this content and refresh this page.