Pretty interesting post here by the venerable Mark Russinovich at SysInternals (Mark is one of the super gurus of Windows kernal programming).
Last week when I was testing the latest version of RootkitRevealer (RKR) I ran a scan on one of my systems and was shocked to see evidence of a rootkit. Rootkits are cloaking technologies that hide files, Registry keys, and other system objects from diagnostic and security software, and they are usually employed by malware attempting to keep their implementation hidden …The RKR results window reported a hidden directory, several hidden device drivers, and a hidden application…
Link here. (Note that I have linked to the main page of his blog, as the permalink has been having problems).