Some tricks from Conficker's bag
http://isc.sans.org/diary.html?storyid=5830&rss