I have an application written in C# that needs to be able to configure the network adapters in Windows. I have this basically working through WMI, but there are a couple of
I can tell you the way the trojans do it, after having to clean up after a few of them, is to set registry keys under HKEY_LOCAL_MACHINE. The main ones they set are the DNS ones and that approach definitely sticks which can be atested to by anyone who has ever been infected and can no longer get to windowsupdate.com, mcafee.com etc.