Though conficker also got the ability to terminate AVs, exploit weak password or Windows service vulnerabilities (in case the OS wasn’t updated) to propagate in the LAN network, tamper the DNS lookup and automatically upgrade an early revision to a more recent one, maybe they didn’t have an AV at all or they simply skipped the signatures updates at least on the 0-day infected PC ???
If a system is infected before an appropriate signature is deployed Conficker, since its first A revision, had the ability to persist in the network/LAN by disabling the AV and/or its updates, propagate by probing for weaknesses and successfully infect by autoupdating itself until it spreads a new version before the other machines get an updated signature.