The server and the logs take the time of the system files, so they are pretty hard to find. The registry startup entry cannot be found easily. Also, the server is undetectable by AVs. So, you\'re right, a rootkit isn\'t a must, but it\'s a nice thing.
Yes, that small screenshot of mouse click could be useful in some cases.