Recently, a co-worker of mine mentioned a neat little fact about Windows 7 x64. By default, Windows 7 x64 requires all Kernel-Mode programs (drivers and low-level services) to be digitally signed before it will load them. Since Rootkits are Kernel-Mode programs, usually loaded before Windows has a chance to load an anti-malware program, and it costs money to get a program or driver approved for digital signing, then Windows should be impervious (or at least better protected) to/against them in its natural state. Here's an article from Microsoft's site:

The article basically says that Windows 7 and Vista x64 require Kernel Mode Code Signing to load Kernel-Mode software. However, this must be proven in a lab before I can anchor myself to it.