The dropper is the portion of the trojan that actually infects the machine. Typical duties of a dropper is to extract the server and configure the system to always run the server upon startup. The dropper usually places the server c:\windows\system directory. In order to make the server run again the next time the victim reboots the machine, a registry entry is added to HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run.
The last task of the dropper is to remove the trojaned program.
