Yeah, when you have a rootkit that's active, there are signals you can look at to claim from a range of "there is most certainly a rootkit" to "there is a small possibility that there is a rootkit".