Since I haven't seen it posted yet I figured I would.
There has been a new rootkit source released recently called KBeast. It's a Linux kernel module rootkit. Has a bunch of features like hiding sockets, processes, files, keylogger etc... Basically all the usual virii type stuff you would expect.
Anyway its there to learn from so enjoy.
http://packetstormsecurity.org/files/108286/KBeast-Kernel-Beast-Linux-Rootkit-2012.html~BinaryShinigami