Huh, that doesn't match my intuitions at all (at least on UNIX-based OSes), so I'm pretty surprised and want to re-adjust my expectations. You're saying that you regularly see compromised machines that are running kernel-mode keyloggers, but only keyloggers? What has the attack vector been, and do you know where they keys are being logged to?