how Rootkit.Avatar looks like in wincheck logs: http://redplait.blogspot.ru/2013/05/how ... ke-in.html
Check Wincheck
A forum for reverse engineering, OS internals and malware analysis