As DippyGirl says it's possible it was a false positive, and as AVG passed it the chances are it was. As far as I'm aware the only way to infect your computer is to run the file the malware is located in, also be aware of popups on the internet advising virus infections and removal, these popups are a way of delivering trojans, once you click OK the popup runs a program to install malware on your system.
It would be wise to let you friend know and get him to scan his system to be on the safe side however.
I scanned another CD from my friend in my PC today. It started up (apparently because of an autorun). This time, AVG's Resident Shield picked up a trojan, but when I scanned the CD with A-Squared Free nothing was detected. Strange.
I scanned the hard drive because of the autorun on the CD, using AVG and A-Squared Free, but nothing was detected. I assume, therefore, that the autorun did not release the trojan onto the hard drive - I hope not, anyway!