diff --git a/scripts/p2p-conficker.nse b/scripts/p2p-conficker.nse
new file mode 100644
index 000000000..78274d44e
--- /dev/null
+++ b/scripts/p2p-conficker.nse
@@ -0,0 +1,634 @@
+description = [[
+Check if a host is infected with Conficker.C or higher, based on Conficker's peer to peer communication. 
+
+When Conficker.C and higher infect a system, it opens four ports: two TCP and two UDP. The ports are 
+random, but are seeded with the current week and the IP of the infected host. By determining the algorithm, 
+one can check if these four ports are open, and can probe them for more data. 
+
+Once the open ports are found, communication can be initiated using Conficker's custom peer to peer protocol. 
+If a valid response is received, then a valid Conficker infection has been found. 
+
+This check won't work properly on a multihomed or NATed system -- the open ports will be based on a nonpublic IP. 
+The argument <code>checkall</code> tells Nmap to attempt communication with every open port (much like a version
+check) and the argument <code>realip</code> tells Nmap to base its port generation on the given ip address instead
+of the actual ip. See the args section for more information. 
+
+By default, this will run against a system that has a standard Windows port open (445, 139, 137). The arguments
+checkall and checkconficker will both perform checks regardless of which port is open, see the args section for
+more information. 
+
+Note: Ensure your clock is correct (within a week) before using this script!
+
+The majority of research for this script was done by Symantec Security Response, and some was taken 
+from public sources (most notably the port blacklisting was found by David Fifield). A big thanks goes
+out to everybody who contributed! 
+]]
+
+--       <pre>nmap -p445 -T4 --script=p2p-conficker --script-args=realip=\"192.168.1.65\" x.x.x.x</pre>
+-- @args checkconficker If set to '1' or 'true', the script will always run on active hosts, 
+--       it doesn't matter if any open ports were detected. 
+--
+-- @usage
+-- # Default modes:
+-- nmap --script p2p-conficker.nse -p445 <host>
+-- sudo nmap -sU -sS --script p2p-conficker.nse -p U:137,T:139 <host>
+--
+-- # Run regardless of which port is open
+-- nmap --script p2p-conficker.nse -p445 --script-args=checkconficker=1 <host>
+--
+-- # Check every port (slow!)
+-- nmap --script p2p-conficker.nse -p- --script-args=checkall=1 <host>
+--
+-- # Base checks on a different ip address (NATed)
+-- nmap --script p2p-conficker.nse -p445 --script-args=realip=\"192.168.1.65\" <host>
+--
+-- @output
+-- Clean machine:
+-- Host script results:
+-- |  p2p-conficker: Checking for Conficker.C or higher...
+-- |  | Check 1 (port 44329/tcp): CLEAN (Couldn't connect)
+-- |  | Check 2 (port 33824/tcp): CLEAN (Couldn't connect)
+-- |  | Check 3 (port 31380/udp): CLEAN (Failed to receive data)
+-- |  | Check 4 (port 52600/udp): CLEAN (Failed to receive data)
+-- |_ |_ 0/4 checks: Host is CLEAN or ports are blocked
+-- 
+-- Infected machine:
+-- Host script results:
+-- |  p2p-conficker: Checking for Conficker.C or higher...
+-- |  | Check 1 (port 18707/tcp): INFECTED (Received valid data)
+-- |  | Check 2 (port 65273/tcp): INFECTED (Received valid data)
+-- |  | Check 3 (port 11722/udp): INFECTED (Received valid data)
+-- |  | Check 4 (port 12690/udp): INFECTED (Received valid data)
+-- |_ |_ 4/4 checks: Host is likely INFECTED
+-- 
+-----------------------------------------------------------------------
+
+author = "Ron Bowes (with research from Symantec Security Response)"
+copyright = "Ron Bowes"
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
+categories = {"default","safe"}
+-- Set the runlevel to 2. This means this script will run last, but it will also run in parallel with smb-check-vulns.nse, 
+-- which will generally be run at the same time. So, by setting this to 2, we increase our parallelism. 
+runlevel = 2
+
+require 'smb'
+require 'stdnse'
+require 'ipOps'
+
+-- Max packet size
+local MAX_PACKET = 0x2000
+
+-- Flags
+local mode_flags =
+{
+	FLAG_MODE              = bit.lshift(1, 0),
+	FLAG_LOCAL_ACK         = bit.lshift(1, 1),
+	FLAG_IS_TCP            = bit.lshift(1, 2),
+	FLAG_IP_INCLUDED       = bit.lshift(1, 3),
+	FLAG_UNKNOWN0_INCLUDED = bit.lshift(1, 4),
+	FLAG_UNKNOWN1_INCLUDED = bit.lshift(1, 5),
+	FLAG_DATA_INCLUDED     = bit.lshift(1, 6),
+	FLAG_SYSINFO_INCLUDED  = bit.lshift(1, 7),
+	FLAG_ENCODED           = bit.lshift(1, 15)
+}
+
+---For a hostrule, simply use the 'smb' ports as an indicator, unless the user overrides it
+hostrule = function(host)
+	if(smb.get_port(host) ~= nil) then
+		return true
+	elseif(nmap.registry.args.checkall == "true" or nmap.registry.args.checkall == "1") then
+		return true
+	elseif(nmap.registry.args.checkconficker == "true" or nmap.registry.args.checkconficker == "1") then
+		return true
+	end
+
+	return false
+end
+
+-- Multiply two 32-bit integers and return a 64-bit product. The first return
+-- value is the low-order 32 bits of the product and the second return value is
+-- the high-order 32 bits.
+--
+--@param u First number (0 <= u <= 0xFFFFFFFF)
+--@param v Second number (0 <= v <= 0xFFFFFFFF)
+--@return 64-bit product of u*v, as a pair of 32-bit integers. 
+local function mul64(u, v)
+	-- This is based on formula (2) from section 4.3.3 of The Art of
+	-- Computer Programming. We split u and v into upper and lower 16-bit
+	-- chunks, such that
+	--   u = 2**16 u1 + u0    and    v = 2**16 v1 + v0
+	-- Then
+	--   u v = (2**16 u1 + u0) * (2**16 v1 + v0)
+	--       = 2**32 u1 v1 + 2**16 (u0 v1 + u1 v0) + u0 v0
+	assert(0 <= u and u <= 0xFFFFFFFF)
+	assert(0 <= v and v <= 0xFFFFFFFF)
+	local u0, u1 = bit.band(u, 0xFFFF), bit.rshift(u, 16)
+	local v0, v1 = bit.band(v, 0xFFFF), bit.rshift(v, 16)
+	-- t uses at most 49 bits, which is within the range of exact integer
+	-- precision of a Lua number.
+	local t = u0 * v0 + (u0 * v1 + u1 * v0) * 65536
+	return bit.band(t, 0xFFFFFFFF), u1 * v1 + bit.rshift(t, 32)
+end
+
+---Rotates the 64-bit integer defined by h:l left by one bit. 
+--
+--@param h The high-order 32 bits
+--@param l The low-order 32 bits
+--@return 64-bit rotated integer, as a pair of 32-bit integers. 
+local function rot64(h, l)
+	local i
+
+	assert(0 <= h and h <= 0xFFFFFFFF)
+	assert(0 <= l and l <= 0xFFFFFFFF)
+
+	local tmp = bit.band(h, 0x80000000)     -- tmp  = h & 0x80000000
+	h = bit.lshift(h, 1)                    -- h = h << 1
+	h = bit.bor(h, bit.rshift(l, 31))       -- h = h | (l >> 31)
+	l = bit.lshift(l, 1)
+	if(tmp ~= 0) then
+		l = bit.bor(l, 1)
+	end
+
+	h = bit.band(h, 0xFFFFFFFF)
+	l = bit.band(l, 0xFFFFFFFF)
+
+	return h, l
+end
+
+
+---Check if a port is Blacklisted. Thanks to David Fifield for determining the purpose of the "magic"
+-- array:
+-- <http://www.bamsoftware.com/wiki/Nmap/PortSetGraphics#conficker>
+--
+-- Basically, each bit in the blacklist array represents a group of 32 ports. If that bit is on, those ports
+-- are blacklisted and will never come up. 
+--
+--@param port The port to check
+--@return true if the port is blacklisted, false otherwise
+local function is_blacklisted_port(port)
+	local r, l
+
+	local blacklist = { 0xFFFFFFFF, 0xFFFFFFFF, 0xF0F6BFBB, 0xBB5A5FF3, 0xF3977011, 0xEB67BFBF, 0x5F9BFAC8, 0x34D88091, 0x1E2282DF, 0x573402C4, 0xC0000084, 0x03000209, 0x01600002, 0x00005000, 0x801000C0, 0x00500040, 0x000000A1, 0x01000000, 0x01000000, 0x00022A20, 0x00000080, 0x04000000, 0x40020000, 0x88000000, 0x00000180, 0x00081000, 0x08801900, 0x00800B81, 0x00000280, 0x080002C0, 0x00A80000, 0x00008000, 0x00100040, 0x00100000, 0x00000000, 0x00000000, 0x10000008, 0x00000000, 0x00000000, 0x00000004, 0x00000002, 0x00000000, 0x00040000, 0x00000000, 0x00000000, 0x00000000, 0x00410000, 0x82000000, 0x00000000, 0x00000000, 0x00000001, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000008, 0x80000000, };
+
+	r = bit.rshift(port, 5)
+	l = bit.lshift(1, bit.band(r, 0x1f))
+	r = bit.rshift(r, 5)
+
+	return (bit.band(blacklist[r + 1], l) ~= 0)
+end
+
+---Generates the four random ports that Conficker uses, based on the current time and the IP address. 
+--
+--@param ip The IP address as a 32-bit little endian integer
+--@param seed The seed, based on the time (<code>floor((time - 345600) / 604800)</code>)
+--@return An array of four ports; the first and third are TCP, and the second and fourth are UDP. 
+local function prng_generate_ports(ip, seed)
+	local ports = {0, 0, 0, 0}
+	local v1, v2
+	local port1, port2, shift1, shift2
+	local i
+	local magic = 0x015A4E35
+
+	stdnse.print_debug(1, "Conficker: Generating ports based on ip (0x%08x) and seed (%d)", ip, seed)
+
+	v1 = -(ip + 1)
+	repeat
+		-- Loop 10 times to generate the first pair of ports
+		for i = 0, 9, 1 do
+			v1, v2 = mul64(bit.band(v1, 0xFFFFFFFF), bit.band(magic, 0xFFFFFFFF))
+
+			-- Add 1 to v1, handling overflows
+			if(v1 ~= 0xFFFFFFFF) then
+				v1 = v1 + 1
+			else
+				v1 = 0
+				v2 = v2 + 1
+			end
+
+			v2 = bit.rshift(v2, i)
+
+			ports[(i % 2) + 1] = bit.bxor(bit.band(v2, 0xFFFF), ports[(i % 2) + 1])
+		end
+	until(is_blacklisted_port(ports[1]) == false and is_blacklisted_port(ports[2]) == false and ports[1] ~= ports[2])
+
+	-- Update the accumlator with the seed
+	v1 = bit.bxor(v1, seed)
+
+	-- Loop 10 more times to generate the second pair of ports
+	repeat
+		for i = 0, 9, 1 do
+			v1, v2 = mul64(bit.band(v1, 0xFFFFFFFF), bit.band(magic, 0xFFFFFFFF))
+
+			-- Add 1 to v1, handling overflows
+			if(v1 ~= 0xFFFFFFFF) then
+				v1 = v1 + 1
+			else
+				v1 = 0
+				v2 = v2 + 1
+			end
+
+			v2 = bit.rshift(v2, i)
+
+			ports[(i % 2) + 3] = bit.bxor(bit.band(v2, 0xFFFF), ports[(i % 2) + 3])
+		end
+	until(is_blacklisted_port(ports[3]) == false and is_blacklisted_port(ports[4]) == false and ports[3] ~= ports[4])
+
+	return {ports[1], ports[2], ports[3], ports[4]}
+end
+
+---Calculate a checksum for the data. This checksum is appended to every Conficker packet before the random noise. 
+-- The checksum includes the key and data, but not the noise and optional length. 
+--
+--@param data The data to create a checksum for.
+--@return An integer representing the checksum. 
+local function p2p_checksum(data)
+	local pos, i
+	local hash = string.len(data)
+
+	stdnse.print_debug(2, "Conficker: Calculating checksum for %d-byte buffer", string.len(data))
+
+	-- Get the first character
+	pos, i = bin.unpack("<C", data)
+	while i ~= nil do
+		local h = bit.bxor(hash, i)
+		-- Incorporate the current character into the checksum
+		hash = bit.bor((h + h), bit.rshift(h, 31))
+		hash = bit.band(hash, 0xFFFFFFFF)
+
+		-- Get the next character
+		pos, i = bin.unpack("<C", data, pos)
+	end
+
+	return hash
+end
+
+---Encrypt/decrypt the buffer with a simple xor-based symmetric encryption. It uses a 64-bit key, represented
+-- by key1:key2, that is transmited in plain text. Since sniffed packets can be decrypted, this is a 
+-- simple obfuscation technique. 
+--
+--@param packet The packet to encrypt (before the key and optional length are prepended). 
+--@param key1 The low-order 32 bits in the key.
+--@param key2 The high-order 32 bits in the key. 
+--@return The encrypted (or decrypted) data. 
+local function p2p_cipher(packet, key1, key2)
+	local i
+	local buf = ""
+
+	for i = 1, string.len(packet), 1 do
+		-- Do a 64-bit rotate on key1:key2
+		key2, key1 = rot64(key2, key1)
+
+		-- Generate the key (the right-most byte)
+		local k = bit.band(key1, 0x0FF)
+
+		-- Xor the current character and add it to the encrypted buffer
+		buf = buf .. string.char(bit.bxor(string.byte(packet, i), k))
+
+		-- Update the key with 'k'
+		key1 = key1 + k
+		if(key1 > 0xFFFFFFFF) then
+			-- Handle overflows
+			key2 = key2 + (bit.rshift(key1, 32))
+			key2 = bit.band(key2, 0xFFFFFFFF)
+			key1 = bit.band(key1, 0xFFFFFFFF)
+		end
+	end
+
+	return buf
+end
+
+---Decrypt the packet, verify it, and parse it. This function will fail with an error if the packet can't be
+-- parsed properly (likely means the port is being used for something else), but will return successfully 
+-- without checking the packet's checksum (although it does calculate the checksum). It's up to the calling
+-- function to decide if it cares about the checksum. 
+--
+--@param packet The packet, without the optional length (if it's TCP). 
+--@return (status, result) If status is true, result is a table (including 'hash' and 'real_hash'). If status
+--        is false, result is a string that indicates why the parse failed. 
+function p2p_parse(packet)
+	local pos = 1
+	local data = {}
+
+	-- Get the key
+	pos, data['key1'], data['key2'] = bin.unpack("<II", packet, pos)
+	if(data['key2'] == nil) then
+		return false, "Packet was too short [1]"
+	end
+
+	-- Decrypt the second half of the packet using the key
+	packet = string.sub(packet, 1, pos - 1) .. p2p_cipher(string.sub(packet, pos), data['key1'], data['key2'])
+
+	-- Parse the flags
+	pos, data['flags'] = bin.unpack("<S", packet, pos)
+	if(data['flags'] == nil) then
+		return false, "Packet was too short [2]"
+	end
+
+	-- Get the IP, if it's present
+	if(bit.band(data['flags'], mode_flags.FLAG_IP_INCLUDED) ~= 0) then
+		pos, data['ip'], data['port'] = bin.unpack("<IS", packet, pos)
+		if(data['ip'] == nil) then
+			return false, "Packet was too short [3]"
+		end
+	end
+
+	-- Read the first unknown value, if present
+	if(bit.band(data['flags'], mode_flags.FLAG_UNKNOWN0_INCLUDED) ~= 0) then
+		pos, data['unknown0'] = bin.unpack("<I", packet, pos)
+		if(data['unknown0'] == nil) then
+			return false, "Packet was too short [3]"
+		end
+	end
+
+	-- Read the second unknown value, if present
+	if(bit.band(data['flags'], mode_flags.FLAG_UNKNOWN1_INCLUDED) ~= 0) then
+		pos, data['unknown1'] = bin.unpack("<I", packet, pos)
+		if(data['unknown1'] == nil) then
+			return false, "Packet was too short [4]"
+		end
+	end
+
+	-- Read the data, if present
+	if(bit.band(data['flags'], mode_flags.FLAG_DATA_INCLUDED) ~= 0) then
+		pos, data['data_flags'], data['data_length'] = bin.unpack("<CS", packet, pos)
+		if(data['data_length'] == nil) then
+			return false, "Packet was too short [5]"
+		end
+		pos, data['data'] = bin.unpack(string.format("A%d", data['data_length']), packet, pos)
+		if(data['data'] == nil) then
+			return false, "Packet was too short [6]"
+		end
+	end
+
+	-- Read the sysinfo, if present
+	if(bit.band(data['flags'], mode_flags.FLAG_SYSINFO_INCLUDED) ~= 0) then
+		pos, data['sysinfo_systemtestflags'], 
+			data['sysinfo_os_major'], 
+			data['sysinfo_os_minor'], 
+			data['sysinfo_os_build'], 
+			data['sysinfo_os_servicepack_major'], 
+			data['sysinfo_os_servicepack_minor'], 
+			data['sysinfo_ntdll_translation_file_information'], 
+			data['sysinfo_prng_sample'], 
+			data['sysinfo_unknown0'], 
+			data['sysinfo_unknown1'], 
+			data['sysinfo_unknown2'], 
+			data['sysinfo_unknown3'], 
+			data['sysinfo_unknown4'] = bin.unpack("<SCCSCCSISSISS", packet, pos)
+		if(data['sysinfo_unknown4'] == nil) then
+			return false, "Packet was too short [7]"
+		end
+	end
+
+	-- Pull out the data that's used in the hash
+	data['hash_data'] = string.sub(packet, 1, pos - 1)
+
+	-- Read the hash
+	pos, data['hash'] = bin.unpack("<I", packet, pos)
+	if(data['hash'] == nil) then
+		return false, "Packet was too short [8]"
+	end
+
+	-- Record the noise
+	data['noise'] = string.sub(packet, pos)
+
+	-- Generate the actual hash (we're going to ignore it for now, but it can be checked higher up)
+	data['real_hash'] = p2p_checksum(data['hash_data'])
+
+	return true, data
+end
+
+---Create a peer to peer packet for the given protocol. 
+--
+--@param protocol The protocol (either 'tcp' or 'udp' -- tcp packets have a length in front, and an extra
+--       flag)
+--@param do_encryption (optional) If set to false, packets aren't encrypted (the key '0' is used). Useful
+--       for testing. Default: true.
+local function p2p_create_packet(protocol, do_encryption)
+	assert(protocol == "tcp" or protocol == "udp")
+
+	local key1 = math.random(1, 0x7FFFFFFF)
+	local key2 = math.random(1, 0x7FFFFFFF)
+
+	-- A key of 0 disables the encryption
+	if(do_encryption == false) then
+		key1 = 0
+		key2 = 0
+	end
+
+	local flags = 0
+
+	-- Set a couple flags that we need (we don't send any optional data)
+	flags = bit.bor(flags, mode_flags.FLAG_MODE)
+	flags = bit.bor(flags, mode_flags.FLAG_ENCODED)
+--	flags = bit.bor(flags, mode_flags.FLAG_LOCAL_ACK)
+	-- Set the special TCP flag
+	if(protocol == "tcp") then
+		flags = bit.bor(flags, mode_flags.FLAG_IS_TCP)
+	end
+
+	-- Add the key and flags that are always present (and skip over the boring stuff)
+	local packet = ""
+	packet = packet .. bin.pack("<II", key1, key2)
+	packet = packet .. bin.pack("<S", flags)
+
+	-- Generate the checksum for the packet
+	local hash = p2p_checksum(packet)
+	packet = packet .. bin.pack("<I", hash)
+
+	-- Encrypt the full packet, except for the key and optional length
+	packet = string.sub(packet, 1, 8) .. p2p_cipher(string.sub(packet, 9), key1, key2)
+
+	-- Add the length in front if it's TCP
+	if(protocol == "tcp") then
+		packet = bin.pack("<SA", string.len(packet), packet)
+	end
+
+	return true, packet
+end
+
+---Checks if conficker is present on the given port/protocol. The ports Conficker uses are fairly standard, so
+-- those should generally be used for this check. This can also be sent to any open port on the system. 
+--
+--@param ip The ip address of the system to check
+--@param port The port to check (can be taken from <code>prng_generate_ports</code>, or from unidentified ports)
+--@return (status, reason, data) Status indicates whether or not Conficker is suspected to be present (<code>true</code) = 
+--        Conficker, <code>false</code> = no Conficker). If status is true, data is the table of information returned by 
+--        Conficker. 
+local function conficker_check(ip, port, protocol)
+	local status, packet
+	local socket
+	local response
+
+	status, packet = p2p_create_packet(protocol)
+	if(status == false) then
+		return false, packet
+	end
+
+	-- Try to connect to the first socket
+	socket = nmap.new_socket()
+	socket:set_timeout(5000)
+	status, response = socket:connect(ip, port, protocol)
+	if(status == false) then
+		return false, "Couldn't establish connection (" .. response .. ")"
+	end
+
+	-- Send the packet
+	socket:send(packet)
+
+	-- Read a response (2 bytes minimum, because that's the TCP length)
+	status, response = socket:receive_bytes(2)
+	if(status == false) then
+		return false, "Couldn't receive bytes: " .. response
+	elseif(response == "ERROR") then
+		return false, "Failed to receive data"
+	elseif(response == "TIMEOUT") then
+		return false, "Timeout"
+	elseif(response == "EOF") then
+		return false, "Couldn't connect"
+	end
+
+	-- If it's TCP, get the length and make sure we have the full packet
+	if(protocol == "tcp") then
+		local length
+		_, length = bin.unpack("<S", response, 1)
+
+		while length > (string.len(response) - 2) do
+			local response2
+
+			status, response2 = socket:receive_bytes(2)
+			if(status == false) then
+				return false, "Couldn't receive bytes: " .. response2
+			elseif(response2 == "ERROR") then
+				return false, "Failed to receive data"
+			elseif(response2 == "TIMEOUT") then
+				return false, "Timeout"
+			elseif(response2 == "EOF") then
+				return false, "Couldn't connect"
+			end
+
+			response = response .. response2
+		end
+
+		-- Remove the 'length' bytes
+		response = string.sub(response, 3)
+	end
+
+	-- Close the socket
+	socket:close()
+
+	local status, result = p2p_parse(response)
+
+	if(status == false) then
+		return false, "Data received, but wasn't Conficker data: " .. result
+	end
+
+	if(result['hash'] ~= result['real_hash']) then
+		return false, "Data received, but checksum was invalid (possibly INFECTED)"
+	end
+
+	return true, "Received valid data", result
+end
+
+local function go(host)
+	local tcp_ports = {}
+	local udp_ports = {}
+	local response = " \n"
+	local i
+	local port, protocol
+	local count = 0
+	local checks = 0
+
+	-- Generate a complete list of valid ports
+	if(nmap.registry.args.checkall == "true" or nmap.registry.args.checkall == "1") then
+		for i = 1, 65535, 1 do
+			if(not(is_blacklisted_port(i))) then
+				local tcp = nmap.get_port_state(host, {number=i, protocol="tcp"})
+				if(tcp ~= nil and tcp.state == "open") then
+					tcp_ports[i] = "true"
+				end
+	
+				local udp = nmap.get_port_state(host, {number=i, protocol="udp"})
+				if(udp ~= nil and (udp.state == "open" or udp.state == "open|filtered")) then
+					udp_ports[i] = "true"
+				end
+			end
+		end
+	end
+
+	-- Generate ports based on the ip and time
+	local seed = math.floor((os.time() - 345600) / 604800)
+	local ip = host.ip
+
+	-- Use the provided IP, if it exists
+	if(nmap.registry.args.realip ~= nil) then
+		ip = nmap.registry.args.realip
+	end
+
+	-- Reverse the IP's endianness
+	ip = ipOps.todword(ip)
+	ip = bin.pack(">I", ip)
+	_, ip = bin.unpack("<I", ip)
+
+	-- Generate the ports
+	local generated_ports = prng_generate_ports(ip, seed)
+	tcp_ports[generated_ports[1]] = true
+	tcp_ports[generated_ports[3]] = true
+	udp_ports[generated_ports[2]] = true
+	udp_ports[generated_ports[4]] = true
+
+	response = string.format("Checking for Conficker.C or higher...\n")
+
+	-- Check the TCP ports
+	for port in pairs(tcp_ports) do
+		local status, reason
+
+		status, reason = conficker_check(host.ip, port, "tcp")
+		checks = checks + 1
+
+		if(status == true) then
+			response = response .. string.format("| Check %d (port %d/%s): INFECTED (%s)\n", checks, port, "tcp", reason)
+			count = count + 1
+		else
+			response = response .. string.format("| Check %d (port %d/%s): CLEAN (%s)\n", checks, port, "tcp", reason)
+		end
+	end
+
+	-- Check the UDP ports
+	for port in pairs(udp_ports) do
+		local status, reason
+
+		status, reason = conficker_check(host.ip, port, "udp")
+		checks = checks + 1
+
+		if(status == true) then
+			response = response .. string.format("| Check %d (port %d/%s): INFECTED (%s)\n", checks, port, "udp", reason)
+			count = count + 1
+		else
+			response = response .. string.format("| Check %d (port %d/%s): CLEAN (%s)\n", checks, port, "udp", reason)
+		end
+	end
+
+
+    -- Check how many INFECTED hits we got
+    if(count == 0) then
+        response = response .. string.format("|_ %d/%d checks: Host is CLEAN or ports are blocked\n", count, checks)
+    else
+        response = response .. string.format("|_ %d/%d checks: Host is likely INFECTED\n", count, checks)
+    end
+
+
+	return true, response
+end
+
+action = function(host)
+	local status, result = go(host)
+
+	if(status == false) then
+		return "ERROR: " .. result
+	else
+		return result
+	end
+end
+
+
diff --git a/scripts/script.db b/scripts/script.db
index bd65a384c..6fc317063 100644
--- a/scripts/script.db
+++ b/scripts/script.db
@@ -1,114 +1,117 @@
-Entry{ category = "discovery", filename = "asn-query.nse" }
-Entry{ category = "external", filename = "asn-query.nse" }
-Entry{ category = "default", filename = "auth-owners.nse" }
-Entry{ category = "safe", filename = "auth-owners.nse" }
-Entry{ category = "malware", filename = "auth-spoof.nse" }
-Entry{ category = "discovery", filename = "banner.nse" }
-Entry{ category = "safe", filename = "banner.nse" }
-Entry{ category = "discovery", filename = "daytime.nse" }
-Entry{ category = "external", filename = "dns-random-srcport.nse" }
-Entry{ category = "intrusive", filename = "dns-random-srcport.nse" }
-Entry{ category = "external", filename = "dns-random-txid.nse" }
-Entry{ category = "intrusive", filename = "dns-random-txid.nse" }
-Entry{ category = "default", filename = "dns-recursion.nse" }
-Entry{ category = "intrusive", filename = "dns-recursion.nse" }
-Entry{ category = "default", filename = "dns-zone-transfer.nse" }
-Entry{ category = "intrusive", filename = "dns-zone-transfer.nse" }
-Entry{ category = "discovery", filename = "dns-zone-transfer.nse" }
-Entry{ category = "default", filename = "finger.nse" }
-Entry{ category = "discovery", filename = "finger.nse" }
-Entry{ category = "default", filename = "ftp-anon.nse" }
-Entry{ category = "auth", filename = "ftp-anon.nse" }
-Entry{ category = "safe", filename = "ftp-anon.nse" }
-Entry{ category = "default", filename = "ftp-bounce.nse" }
-Entry{ category = "intrusive", filename = "ftp-bounce.nse" }
-Entry{ category = "auth", filename = "ftp-brute.nse" }
-Entry{ category = "intrusive", filename = "ftp-brute.nse" }
-Entry{ category = "default", filename = "html-title.nse" }
-Entry{ category = "discovery", filename = "html-title.nse" }
-Entry{ category = "safe", filename = "html-title.nse" }
-Entry{ category = "default", filename = "http-auth.nse" }
-Entry{ category = "auth", filename = "http-auth.nse" }
-Entry{ category = "intrusive", filename = "http-auth.nse" }
-Entry{ category = "default", filename = "http-open-proxy.nse" }
-Entry{ category = "discovery", filename = "http-open-proxy.nse" }
-Entry{ category = "external", filename = "http-open-proxy.nse" }
-Entry{ category = "intrusive", filename = "http-open-proxy.nse" }
-Entry{ category = "intrusive", filename = "http-passwd.nse" }
-Entry{ category = "vuln", filename = "http-passwd.nse" }
-Entry{ category = "discovery", filename = "http-trace.nse" }
-Entry{ category = "version", filename = "iax2-version.nse" }
-Entry{ category = "default", filename = "irc-info.nse" }
-Entry{ category = "discovery", filename = "irc-info.nse" }
-Entry{ category = "default", filename = "ms-sql-info.nse" }
-Entry{ category = "discovery", filename = "ms-sql-info.nse" }
-Entry{ category = "intrusive", filename = "ms-sql-info.nse" }
-Entry{ category = "default", filename = "mysql-info.nse" }
-Entry{ category = "discovery", filename = "mysql-info.nse" }
-Entry{ category = "safe", filename = "mysql-info.nse" }
-Entry{ category = "default", filename = "nbstat.nse" }
-Entry{ category = "discovery", filename = "nbstat.nse" }
-Entry{ category = "safe", filename = "nbstat.nse" }
-Entry{ category = "intrusive", filename = "pop3-brute.nse" }
-Entry{ category = "auth", filename = "pop3-brute.nse" }
-Entry{ category = "default", filename = "pop3-capabilities.nse" }
-Entry{ category = "version", filename = "pptp-version.nse" }
-Entry{ category = "default", filename = "realvnc-auth-bypass.nse" }
-Entry{ category = "vuln", filename = "realvnc-auth-bypass.nse" }
-Entry{ category = "default", filename = "robots.txt.nse" }
-Entry{ category = "discovery", filename = "robots.txt.nse" }
-Entry{ category = "safe", filename = "robots.txt.nse" }
-Entry{ category = "default", filename = "rpcinfo.nse" }
-Entry{ category = "safe", filename = "rpcinfo.nse" }
-Entry{ category = "discovery", filename = "rpcinfo.nse" }
-Entry{ category = "version", filename = "skypev2-version.nse" }
-Entry{ category = "intrusive", filename = "smb-brute.nse" }
-Entry{ category = "auth", filename = "smb-brute.nse" }
-Entry{ category = "intrusive", filename = "smb-check-vulns.nse" }
-Entry{ category = "discovery", filename = "smb-enum-domains.nse" }
-Entry{ category = "intrusive", filename = "smb-enum-domains.nse" }
-Entry{ category = "discovery", filename = "smb-enum-processes.nse" }
-Entry{ category = "intrusive", filename = "smb-enum-processes.nse" }
-Entry{ category = "discovery", filename = "smb-enum-sessions.nse" }
-Entry{ category = "intrusive", filename = "smb-enum-sessions.nse" }
-Entry{ category = "discovery", filename = "smb-enum-shares.nse" }
-Entry{ category = "intrusive", filename = "smb-enum-shares.nse" }
-Entry{ category = "discovery", filename = "smb-enum-users.nse" }
-Entry{ category = "intrusive", filename = "smb-enum-users.nse" }
-Entry{ category = "default", filename = "smb-os-discovery.nse" }
-Entry{ category = "discovery", filename = "smb-os-discovery.nse" }
-Entry{ category = "safe", filename = "smb-os-discovery.nse" }
-Entry{ category = "intrusive", filename = "smb-pwdump.nse" }
-Entry{ category = "discovery", filename = "smb-security-mode.nse" }
-Entry{ category = "safe", filename = "smb-security-mode.nse" }
-Entry{ category = "discovery", filename = "smb-server-stats.nse" }
-Entry{ category = "intrusive", filename = "smb-server-stats.nse" }
-Entry{ category = "discovery", filename = "smb-system-info.nse" }
-Entry{ category = "intrusive", filename = "smb-system-info.nse" }
-Entry{ category = "default", filename = "smtp-commands.nse" }
-Entry{ category = "discovery", filename = "smtp-commands.nse" }
-Entry{ category = "safe", filename = "smtp-commands.nse" }
-Entry{ category = "demo", filename = "smtp-open-relay.nse" }
-Entry{ category = "malware", filename = "smtp-strangeport.nse" }
-Entry{ category = "discovery", filename = "sniffer-detect.nse" }
-Entry{ category = "intrusive", filename = "snmp-brute.nse" }
-Entry{ category = "auth", filename = "snmp-brute.nse" }
-Entry{ category = "default", filename = "snmp-sysdescr.nse" }
-Entry{ category = "discovery", filename = "snmp-sysdescr.nse" }
-Entry{ category = "safe", filename = "snmp-sysdescr.nse" }
-Entry{ category = "intrusive", filename = "sql-injection.nse" }
-Entry{ category = "vuln", filename = "sql-injection.nse" }
-Entry{ category = "safe", filename = "ssh-hostkey.nse" }
-Entry{ category = "default", filename = "ssh-hostkey.nse" }
-Entry{ category = "intrusive", filename = "ssh-hostkey.nse" }
-Entry{ category = "default", filename = "sshv1.nse" }
-Entry{ category = "safe", filename = "sshv1.nse" }
-Entry{ category = "default", filename = "sslv2.nse" }
-Entry{ category = "safe", filename = "sslv2.nse" }
-Entry{ category = "auth", filename = "telnet-brute.nse" }
-Entry{ category = "intrusive", filename = "telnet-brute.nse" }
-Entry{ category = "default", filename = "upnp-info.nse" }
-Entry{ category = "safe", filename = "upnp-info.nse" }
-Entry{ category = "discovery", filename = "whois.nse" }
-Entry{ category = "external", filename = "whois.nse" }
-Entry{ category = "safe", filename = "whois.nse" }
+Entry { category = "default", filename = "upnp-info.nse" }
+Entry { category = "safe", filename = "upnp-info.nse" }
+Entry { category = "default", filename = "ftp-anon.nse" }
+Entry { category = "auth", filename = "ftp-anon.nse" }
+Entry { category = "safe", filename = "ftp-anon.nse" }
+Entry { category = "discovery", filename = "smb-enum-users.nse" }
+Entry { category = "intrusive", filename = "smb-enum-users.nse" }
+Entry { category = "external", filename = "dns-random-srcport.nse" }
+Entry { category = "intrusive", filename = "dns-random-srcport.nse" }
+Entry { category = "default", filename = "dns-zone-transfer.nse" }
+Entry { category = "intrusive", filename = "dns-zone-transfer.nse" }
+Entry { category = "discovery", filename = "dns-zone-transfer.nse" }
+Entry { category = "version", filename = "pptp-version.nse" }
+Entry { category = "discovery", filename = "sniffer-detect.nse" }
+Entry { category = "default", filename = "http-open-proxy.nse" }
+Entry { category = "discovery", filename = "http-open-proxy.nse" }
+Entry { category = "external", filename = "http-open-proxy.nse" }
+Entry { category = "intrusive", filename = "http-open-proxy.nse" }
+Entry { category = "malware", filename = "smtp-strangeport.nse" }
+Entry { category = "demo", filename = "smtp-open-relay.nse" }
+Entry { category = "intrusive", filename = "smb-check-vulns.nse" }
+Entry { category = "default", filename = "ms-sql-info.nse" }
+Entry { category = "discovery", filename = "ms-sql-info.nse" }
+Entry { category = "intrusive", filename = "ms-sql-info.nse" }
+Entry { category = "discovery", filename = "smb-enum-shares.nse" }
+Entry { category = "intrusive", filename = "smb-enum-shares.nse" }
+Entry { category = "intrusive", filename = "smb-brute.nse" }
+Entry { category = "auth", filename = "smb-brute.nse" }
+Entry { category = "default", filename = "smtp-commands.nse" }
+Entry { category = "discovery", filename = "smtp-commands.nse" }
+Entry { category = "safe", filename = "smtp-commands.nse" }
+Entry { category = "version", filename = "iax2-version.nse" }
+Entry { category = "intrusive", filename = "sql-injection.nse" }
+Entry { category = "vuln", filename = "sql-injection.nse" }
+Entry { category = "auth", filename = "ftp-brute.nse" }
+Entry { category = "intrusive", filename = "ftp-brute.nse" }
+Entry { category = "discovery", filename = "banner.nse" }
+Entry { category = "safe", filename = "banner.nse" }
+Entry { category = "discovery", filename = "smb-enum-processes.nse" }
+Entry { category = "intrusive", filename = "smb-enum-processes.nse" }
+Entry { category = "discovery", filename = "smb-enum-sessions.nse" }
+Entry { category = "intrusive", filename = "smb-enum-sessions.nse" }
+Entry { category = "discovery", filename = "daytime.nse" }
+Entry { category = "default", filename = "robots.txt.nse" }
+Entry { category = "discovery", filename = "robots.txt.nse" }
+Entry { category = "safe", filename = "robots.txt.nse" }
+Entry { category = "discovery", filename = "asn-query.nse" }
+Entry { category = "external", filename = "asn-query.nse" }
+Entry { category = "discovery", filename = "smb-system-info.nse" }
+Entry { category = "intrusive", filename = "smb-system-info.nse" }
+Entry { category = "intrusive", filename = "snmp-brute.nse" }
+Entry { category = "auth", filename = "snmp-brute.nse" }
+Entry { category = "discovery", filename = "smb-server-stats.nse" }
+Entry { category = "intrusive", filename = "smb-server-stats.nse" }
+Entry { category = "default", filename = "http-auth.nse" }
+Entry { category = "auth", filename = "http-auth.nse" }
+Entry { category = "intrusive", filename = "http-auth.nse" }
+Entry { category = "default", filename = "sshv1.nse" }
+Entry { category = "safe", filename = "sshv1.nse" }
+Entry { category = "default", filename = "smb-os-discovery.nse" }
+Entry { category = "discovery", filename = "smb-os-discovery.nse" }
+Entry { category = "safe", filename = "smb-os-discovery.nse" }
+Entry { category = "default", filename = "auth-owners.nse" }
+Entry { category = "safe", filename = "auth-owners.nse" }
+Entry { category = "default", filename = "p2p-conficker.nse" }
+Entry { category = "safe", filename = "p2p-conficker.nse" }
+Entry { category = "version", filename = "skypev2-version.nse" }
+Entry { category = "intrusive", filename = "smb-pwdump.nse" }
+Entry { category = "default", filename = "dns-recursion.nse" }
+Entry { category = "intrusive", filename = "dns-recursion.nse" }
+Entry { category = "intrusive", filename = "smb-check-vulns-2.nse" }
+Entry { category = "default", filename = "html-title.nse" }
+Entry { category = "discovery", filename = "html-title.nse" }
+Entry { category = "safe", filename = "html-title.nse" }
+Entry { category = "discovery", filename = "whois.nse" }
+Entry { category = "external", filename = "whois.nse" }
+Entry { category = "safe", filename = "whois.nse" }
+Entry { category = "safe", filename = "ssh-hostkey.nse" }
+Entry { category = "default", filename = "ssh-hostkey.nse" }
+Entry { category = "intrusive", filename = "ssh-hostkey.nse" }
+Entry { category = "external", filename = "dns-random-txid.nse" }
+Entry { category = "intrusive", filename = "dns-random-txid.nse" }
+Entry { category = "default", filename = "realvnc-auth-bypass.nse" }
+Entry { category = "vuln", filename = "realvnc-auth-bypass.nse" }
+Entry { category = "default", filename = "snmp-sysdescr.nse" }
+Entry { category = "discovery", filename = "snmp-sysdescr.nse" }
+Entry { category = "safe", filename = "snmp-sysdescr.nse" }
+Entry { category = "default", filename = "mysql-info.nse" }
+Entry { category = "discovery", filename = "mysql-info.nse" }
+Entry { category = "safe", filename = "mysql-info.nse" }
+Entry { category = "default", filename = "pop3-capabilities.nse" }
+Entry { category = "discovery", filename = "http-trace.nse" }
+Entry { category = "default", filename = "ftp-bounce.nse" }
+Entry { category = "intrusive", filename = "ftp-bounce.nse" }
+Entry { category = "discovery", filename = "smb-enum-domains.nse" }
+Entry { category = "intrusive", filename = "smb-enum-domains.nse" }
+Entry { category = "discovery", filename = "smb-security-mode.nse" }
+Entry { category = "safe", filename = "smb-security-mode.nse" }
+Entry { category = "intrusive", filename = "http-passwd.nse" }
+Entry { category = "vuln", filename = "http-passwd.nse" }
+Entry { category = "auth", filename = "telnet-brute.nse" }
+Entry { category = "intrusive", filename = "telnet-brute.nse" }
+Entry { category = "default", filename = "rpcinfo.nse" }
+Entry { category = "safe", filename = "rpcinfo.nse" }
+Entry { category = "discovery", filename = "rpcinfo.nse" }
+Entry { category = "default", filename = "finger.nse" }
+Entry { category = "discovery", filename = "finger.nse" }
+Entry { category = "default", filename = "irc-info.nse" }
+Entry { category = "discovery", filename = "irc-info.nse" }
+Entry { category = "default", filename = "sslv2.nse" }
+Entry { category = "safe", filename = "sslv2.nse" }
+Entry { category = "default", filename = "nbstat.nse" }
+Entry { category = "discovery", filename = "nbstat.nse" }
+Entry { category = "safe", filename = "nbstat.nse" }
+Entry { category = "malware", filename = "auth-spoof.nse" }
+Entry { category = "intrusive", filename = "pop3-brute.nse" }
+Entry { category = "auth", filename = "pop3-brute.nse" }