More information on the mode of operation of the SSHD Rootkit:

http://isc.sans.edu/diary/SSHD+rootkit+in+the+wild/15229