Yeah, Conficker was pretty easy to detect at the network level. I worked at an .edu at the time and set up alarms for it. Fortunately, it was trivial for us to identify the user who owned the device, kill their network access, then wait for them to call the help desk.