DKOM Rootkits using a same approach for e.g , but ms hotpatch is not involved because its new and limited to newer versions of the OS and you cannot take advantage of such things in w2k or even plain xp . all bets for usermode rootkits are off , but some similar techniques are playing a major role there too , but not using ms hotpatch as far as i know . rootkit.com's forum is another good place to ask for this :)