Abstract: Key windows kernol rootkit based on windows layer drivers have been researched.The techniques of  a rootkit attaching itself to the chain of drivers,getting data from IRP and  hiding itself  are introduced.The techniques of rootkit detection is discussed.

Key words: layer drivers, rootkit, IRP