Since I haven't actually got my hands on an infected machine, here are a couple of links.
http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VNameWORM_DOWNAD.E&VSectP<br />
http://blog.trendmicro.com/a-look-inside-conficker-p2p-traffic/
– Main.FredPettis - 23 Apr 2009