You mentioned the two methods I had in mind. These days there is a third one, but it seems to require cooperation from Windows Update. MSI (for example) uses it. As far I as can see, they simply create a fake ACPI node for which Windows Update will silently download a "driver", which in turn downloads the crapware.
