As stated above, root kits work similar on a virtual host as they do on a normal host EXCEPT that many malware/virus/rootkit authors have developed mechanisms to detect whether or not they are in a virtual machine, so they can be scripted/programmed to behave differently than they would on a normal machine.
This is highly evident when reverse engineering malware, where malware will behave different if it detects it is virtualized. Some of the behavior may be to stop from doing its normal routines/functions, try to delete itself. This is similar to malware checking to see if a host is running reverse engineering tools, e.g., IDA Pro, OllyDBG, Immunity Debugger, Redline, etc.
VMWare has an "antirootkit" approach to certain things since the vmware agent will monitor things like changes to the SSDT and IDT (system service descriptor table, and interrupt descriptor tables). At the end of the day though, the behavior is MOSTLY the same.