Since I haven't actually got my hands on an infected machine, here are a couple of links.

http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VNameWORM_DOWNAD.E&VSectP<br /> http://blog.trendmicro.com/a-look-inside-conficker-p2p-traffic/

– Main.FredPettis - 23 Apr 2009