Trendmicro released a new signature for “WORM_DOWNAD.E” yesterday and had a good review of some changes that they are detecting in the Conficker saga:

http://blog.trendmicro.com/downadconficker-watch-new-variant-in-the-mix/