It doesn't need to be explicitly run by the victim. It could possibly be placed in the startup folder, or the run key in the registry and you would have no idea, unless you were super paranoid...