When first run Troj/Bdoor-AOH copies itself to <Windows>\WindowsUpdate.exe
and creates the file:
<Windows>\admintxt.txt
Troj/Bdoor-AOH creates the following registry entries to run itself at startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows Update
WindowsUpdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Windows Update
WindowsUpdate.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
Windows Update
WindowsUpdate.exe