Nothing is sacred on a system once it has intruders.
Although I admit to seeing more use of the rootkit tools than any other, there are still others that are floating around and are in use. Whether the intruder knows what exactly a tool modifies or not is a mute point. The technology to change these files has always been there for the taking. And all the intruders love to trade their warez, so its just a matter of time before any such a tool is well distributed. A good example of this is rootkit.