1. Please see Data Structures and Advanced Data Structures for Graph, Binary Tree, BST and Linked List based Algorithms

2. By modifying the linked list containing a list of all active threads and processes, this type of rootkit can essentially hide all traces from the Object Manager by wrapping the pointer away from the rootkit itself.