Troj/FakeAV-AHD is a Trojan for the Windows platform.
When first run Troj/FakeAV-AHD copies itself to <System>\winupdate.exe and creates the following files:
<System>\41.exe
<System>\avr09.exe
<System>\winhelper.dll
The following registry entry is created to run winupdate.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winupdate.exe
<System>\winupdate.exe
Registry entries are created under:
HKCU\Software