Troj/FakeAV-LD is a Trojan for the Windows platform.
When first run, Troj/FakeAV-LD copies itself to:
<System>\sysguard.exe
and creates the following registry entry to launch itself at system startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\system tool
<System>\sysguard.exe
Troj/FakeAV-LD alters the hosts file to provide fraudulent responses for security application domain requests.
Troj/FakeAV-LD contains the functionality to communicate with a remove server via http, and will attempt to download and run additional code.