There is Kernel Drivers you do this, using hooks and unhooking, follow my blog to know how to hook SYSENTER (Lower than AV): http://codeempire.blogspot.co.uk/2013/10/kernel-driver-sysenter-hook.html
If you hook this you can delete any file even if it has a rootkit. It is all about finding tricks, I like to find my own ways rather than using the same old techniques, other use.