Troj/Daemoni-I drops sdchost.exe, sdchosts.exe and sdchostc.exe. It may also set a registry entry in:
HKLM\SOFTWARE\Microsoft\dadsdasdn.
The sdchost.exe component waits for an active internet connection and then launches both sdchosts and sdchostc which will listen to a random port which will carry out simple port mapping or HTML proxying. sdchost.exe may also attempt to notify a remote host of the existing server.