Here is a method suggested for bypassing UAC in Vista that can be added to Rootkits.

https://www.rootkit.com/newsread.php?newsid=773