a good source of information on this subject can be gained from reading the material at this site: http://www.rootkit.com
not only how they are built, but ways to detect and prevent...