Virus Droppers

A dropper is a program that, when run will attempt to install a regular virus onto your hard disk.

Normally, you obtain a virus by either attempting to boot from an infected floppy disk, by running an infected file, or by loading an infected document with viral macro commands in it. There is another way you can pick up a virus: by encountering a virus dropper. These are rare, but now and again someone will attempt to be clever and try to program one.

Basically, a dropper is just what the name implies: a program designed to run and install (or “drop”) a virus onto your system. The program itself is not infected nor is it a virus because it does not replicate. So, technically, a dropper should be considered a Trojan. Often, because the virus is hidden in the program code, a scanner will not detect the danger until after the virus is dropped onto your system. (It’s technically possible to write a virus that also drops other viruses, and several have been tried. Most are very buggy, however.)

It’s a technical point, but there is a class of dropper that only infects the computer’s memory, not the disk. These are given the name injector by some virus researchers.

A dropper is a program (malware component) that has been designed to “install” some sort of malware (virus, backdoor, etc) to a target system. The malware code can be contained within the dropper (single-stage) in such a way as to avoid detection by virus scanners or the dropper may download the malware to the target machine once activated (two stage).

There are two major types of droppers, those that do not require user interaction which perform through the exploitation of a system by some vulnerability and those that require user interaction by convincing the user that it is some legitimate or benign program. A dropper which installs a malware program to memory only is sometimes called an injector.

Summary

A Trojan program that installs a virus onto your system is called a dropper.
Fortunately, because of technical difficulties, droppers are hard to program and therefore rare.

That’s the end of the introduction. Now for the detail…