REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Blackmal / Nyxem / KamaSutra]
"szFolder"="Virus Filters"
"szDescr"="The sending machine may be infected with the Sober.x virus."
"RGBValue"=dword:00800080
"dwVersion"=dword:00000003
"bDeleted"=dword:00000000
"FilterBuffer"=hex:94,0a,00,00,05,00,00,00,17,00,85,02,1f,00,20,00,00,aa,00,06,\
  00,6e,00,00,00,00,00,00,00,00,00,66,02,9c,02,00,00,1f,00,00,b5,00,00,00,00,\
  01,00,06,00,02,00,00,dc,05,03,0c,21,00,19,02,28,00,0c,01,00,00,00,00,45,52,\
  43,50,19,02,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,28,00,03,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,50,01,ed,51,00,15,15,48,15,6f,15,74,\
  15,20,15,4d,15,6f,15,76,15,69,15,65,41,00,1d,15,41,15,20,15,47,15,72,15,65,\
  15,61,15,74,15,20,15,56,15,69,15,64,15,65,15,6f,41,00,24,15,46,15,77,15,3a,\
  15,20,15,44,15,53,15,43,15,2d,15,30,15,30,15,34,15,36,15,35,0b,15,6a,15,70,\
  15,67,41,00,19,15,46,15,77,15,3a,15,20,15,46,15,75,15,6e,15,6e,15,79,15,20,\
  15,3a,41,00,19,15,46,15,77,15,3a,15,20,15,50,15,69,15,63,15,74,15,75,15,72,\
  15,73,41,00,1d,15,46,15,77,15,3a,15,20,15,52,15,65,15,61,15,6c,15,20,15,73,\
  15,68,15,6f,15,77,41,00,18,15,46,15,77,15,3a,15,20,15,53,15,65,15,58,0b,15,\
  6d,15,70,15,67,41,00,13,15,46,15,77,15,3a,15,20,15,53,15,65,15,78,15,79,41,\
  00,31,15,46,15,77,15,64,15,3a,15,20,15,43,15,72,15,61,15,7a,15,79,15,20,15,\
  69,15,6c,15,6c,15,65,15,67,15,61,15,6c,15,20,15,53,15,65,15,78,15,21,41,00,\
  1e,15,46,15,77,15,64,15,3a,15,20,15,69,15,6d,15,61,15,67,15,65,0b,15,6a,15,\
  70,15,67,41,00,17,15,46,15,77,15,64,15,3a,15,20,15,50,15,68,15,6f,15,74,15,\
  6f,41,00,1f,15,67,15,69,15,76,15,65,15,20,15,6d,15,65,15,20,15,61,15,20,15,\
  6b,15,69,15,73,15,73,41,00,25,15,4d,15,69,15,73,15,73,15,20,15,4c,15,65,15,\
  62,15,61,15,6e,15,6f,15,6e,15,20,15,32,15,30,15,30,15,36,41,00,6d,15,50,15,\
  61,15,72,15,74,15,20,15,31,15,20,15,6f,15,66,15,20,15,36,15,20,15,56,15,69,\
  15,64,15,65,15,6f,15,20,15,63,15,6c,15,69,15,70,15,65,15,53,15,63,15,68,15,\
  6f,15,6f,15,6c,15,20,15,67,15,69,15,72,15,6c,15,20,15,66,15,61,15,6e,15,74,\
  15,61,15,73,15,69,15,65,15,73,15,20,15,67,15,6f,15,6e,15,65,15,20,15,62,15,\
  61,15,64,42,01,e7,42,01,ed,00,28,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\
  00,42,21,01,00,80,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  17,00,00,00,1f,00,20,00,00,05,00,06,00,19,00,00,00,00,00,00,00,00,00,e5,03,\
  81,06,00,00,1f,00,00,36,00,00,00,00,01,00,06,00,02,00,00,dc,05,03,0c,22,00,\
  98,03,28,00,0c,01,00,00,00,00,45,52,43,50,98,03,00,00,00,00,00,00,00,00,00,\
  00,01,00,00,00,00,00,00,00,28,00,03,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  50,03,6a,51,00,80,15,4e,15,6f,15,74,15,65,15,3a,15,20,15,66,15,6f,15,72,15,\
  77,15,61,15,72,15,64,15,65,15,64,15,20,15,6d,15,65,15,73,15,73,15,61,15,67,\
  15,65,15,20,15,61,15,74,15,74,15,61,15,63,15,68,15,65,15,64,0b,15,20,15,59,\
  15,6f,15,75,15,20,15,4d,15,75,15,73,15,74,15,20,15,56,15,69,15,65,15,77,15,\
  20,15,54,15,68,15,69,15,73,15,20,15,56,15,69,15,64,15,65,15,6f,15,63,15,6c,\
  15,69,15,70,15,21,41,00,2b,15,3e,15,3e,15,20,15,66,15,6f,15,72,15,77,15,61,\
  15,72,15,64,15,65,15,64,15,20,15,6d,15,65,15,73,15,73,15,61,15,67,15,65,41,\
  00,1d,15,52,15,65,15,3a,15,20,15,53,15,65,15,78,15,20,15,56,15,69,15,64,15,\
  65,15,6f,41,00,3c,15,69,15,20,15,6a,15,75,15,73,15,74,15,20,15,61,15,6e,15,\
  79,15,20,15,6f,15,6e,15,65,15,20,15,73,15,65,15,65,15,20,15,6d,15,79,15,20,\
  15,70,15,68,15,6f,15,74,15,6f,15,73,0b,41,00,1b,15,49,15,74,15,27,15,73,15,\
  20,15,46,15,72,15,65,15,65,15,20,15,3a,15,29,41,00,31,15,54,15,68,15,65,15,\
  20,15,42,15,65,15,73,15,74,15,20,15,56,15,69,15,64,15,65,15,6f,15,63,15,6c,\
  15,69,15,70,15,20,15,45,15,76,15,65,15,72,41,00,2b,15,48,15,6f,15,74,15,20,\
  15,58,15,58,15,58,15,20,15,59,15,61,15,68,15,6f,15,6f,15,20,15,47,15,72,15,\
  6f,15,75,15,70,15,73,41,00,2f,15,46,15,75,15,63,15,6b,15,69,15,6e,15,20,15,\
  4b,15,61,15,6d,15,61,15,20,15,53,15,75,15,74,15,72,15,61,15,20,15,70,15,69,\
  15,63,15,73,41,00,2b,15,72,15,65,15,61,15,64,15,79,15,20,15,74,15,6f,15,20,\
  15,62,15,65,15,20,15,46,15,55,15,43,15,4b,15,45,15,44,15,20,15,3b,41,00,39,\
  15,66,15,6f,15,72,15,77,15,61,15,72,15,64,15,65,15,64,15,20,15,6d,15,65,15,\
  73,15,73,15,61,15,67,15,65,15,20,15,61,15,74,15,74,15,61,15,63,15,68,15,65,\
  15,64,15,2e,41,00,32,15,56,15,49,15,44,15,45,15,4f,15,53,15,21,15,20,15,46,\
  15,52,15,45,15,45,15,21,15,20,15,28,15,55,15,53,14,15,20,15,30,15,2c,15,30,\
  15,30,15,29,41,00,0b,15,57,15,68,15,61,1c,74,41,00,23,15,69,15,20,15,73,15,\
  65,15,6e,15,64,15,20,15,74,15,68,15,65,15,20,15,66,15,69,15,6c,15,65,15,2e,\
  41,00,3b,15,48,15,65,15,6c,15,6c,15,6f,15,69,15,20,15,61,15,74,15,74,15,61,\
  15,63,15,68,15,65,15,64,15,20,15,74,15,68,15,65,15,20,15,64,15,65,15,74,15,\
  61,15,69,15,6c,15,73,15,2e,41,00,15,15,54,15,68,15,61,15,6e,15,6b,15,20,15,\
  79,15,6f,15,75,41,00,39,15,74,15,68,15,65,15,20,15,66,15,69,15,6c,15,65,15,\
  20,15,69,15,20,15,73,15,65,15,6e,15,64,15,20,15,74,15,68,15,65,15,20,15,64,\
  15,65,15,74,15,61,15,69,15,6c,15,73,41,00,2b,15,50,15,6c,15,65,15,61,15,73,\
  15,65,15,20,15,73,15,65,15,65,15,20,15,74,15,68,15,65,15,20,15,66,15,69,15,\
  6c,15,65,15,2e,41,00,19,15,68,15,6f,15,77,15,20,15,61,15,72,15,65,15,20,15,\
  79,15,6f,1c,75,41,00,29,15,69,15,20,15,73,15,65,15,6e,15,64,15,20,15,74,15,\
  68,15,65,15,20,15,64,15,65,15,74,15,61,15,69,15,6c,15,73,15,2e,42,03,64,42,\
  03,6a,00,00,00,28,00,00,00,01,00,00,00,00,00,00,00,00,00,00,40,40,43,d5,00,\
  40,03,14,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,13,04,00,00,00,\
  00,1f,00,00,83,00,00,00,00,01,00,06,00,02,00,00,dc,05,03,0c,23,00,c6,03,28,\
  00,0c,01,00,00,00,00,45,52,43,50,c6,03,00,00,00,00,00,00,00,00,00,00,01,00,\
  00,00,00,00,00,00,28,00,03,00,00,00,00,00,00,00,00,00,00,00,00,00,50,03,9a,\
  51,00,11,15,30,15,30,15,37,15,2e,15,70,15,69,15,66,41,00,33,15,33,15,39,15,\
  32,15,33,15,31,15,35,15,30,15,38,15,39,15,37,15,30,15,32,15,36,15,30,15,36,\
  15,45,15,2d,15,30,15,32,15,2c,15,2e,15,73,15,63,15,52,41,00,11,15,36,15,37,\
  15,37,15,2e,15,70,15,69,15,66,41,00,23,15,41,15,64,15,75,15,6c,15,74,15,73,\
  15,5f,15,39,15,2c,15,7a,15,69,15,70,15,2e,15,73,15,43,15,52,41,00,2f,15,41,\
  15,72,15,61,15,62,15,20,15,73,15,65,15,78,15,20,15,44,15,53,15,43,15,2d,15,\
  30,15,30,15,34,15,36,15,35,15,2e,15,6a,15,70,15,67,41,00,1d,15,41,15,54,15,\
  54,15,30,15,31,15,2e,15,7a,15,69,15,70,15,2e,15,73,15,43,15,52,41,00,4a,15,\
  41,15,74,15,74,15,61,15,63,15,68,15,6d,15,65,15,6e,15,74,15,73,3b,00,00,00,\
  00,00,00,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,15,2c,15,42,15,36,15,34,15,2e,15,73,15,43,15,72,41,00,1d,15,43,\
  15,6c,15,69,15,70,15,65,15,2c,15,7a,15,69,15,70,15,2e,15,73,15,43,15,72,41,\
  00,1b,15,64,15,6f,15,63,15,75,15,6d,15,65,15,6e,15,74,15,2e,15,70,15,69,15,\
  66,41,00,1d,15,44,15,53,15,43,15,2d,15,30,15,30,15,34,15,36,15,35,15,2e,15,\
  50,15,69,15,66,41,00,1d,15,44,15,53,15,43,15,2d,15,30,15,30,15,34,15,36,15,\
  35,15,2e,15,70,15,49,15,66,41,00,15,15,65,15,42,15,6f,15,6f,15,6b,15,2e,15,\
  70,15,64,15,66,41,00,15,15,65,15,42,15,6f,15,6f,15,6b,15,2e,15,50,15,49,15,\
  46,41,00,19,15,69,15,6d,15,61,15,67,15,65,15,30,15,34,15,2e,15,70,15,69,15,\
  66,41,00,1d,15,4e,15,65,15,77,15,20,15,56,15,69,15,64,15,65,15,6f,15,2c,15,\
  7a,15,69,15,70,41,00,2d,15,4e,15,65,15,77,15,5f,15,44,15,6f,15,63,15,75,15,\
  6d,15,65,15,6e,15,74,15,5f,15,66,15,69,15,6c,15,65,15,2e,15,70,15,69,15,66,\
  41,00,15,15,70,15,68,15,6f,15,74,15,6f,15,2e,15,70,15,69,15,66,41,00,1f,15,\
  50,15,68,15,6f,15,74,15,6f,15,73,15,2c,15,7a,15,69,15,70,15,2e,15,73,15,43,\
  15,52,41,00,17,15,53,15,63,15,68,15,6f,15,6f,15,6c,15,2e,15,70,15,69,15,66,\
  41,00,19,15,53,15,65,15,58,15,2c,15,7a,15,69,15,70,15,2e,15,73,15,63,15,52,\
  41,00,11,15,53,15,65,15,78,15,2e,15,6d,15,69,15,6d,41,00,1f,15,56,15,69,15,\
  64,15,65,15,6f,15,5f,15,70,15,61,15,72,15,74,15,2e,15,6d,15,69,15,6d,41,00,\
  1f,15,57,15,69,15,6e,15,5a,15,69,15,70,15,2c,15,7a,15,69,15,70,15,2e,15,73,\
  15,63,15,52,41,00,17,15,57,15,69,15,6e,15,5a,15,69,15,70,15,2e,15,42,15,48,\
  15,58,41,00,1f,15,57,15,69,15,6e,15,5a,15,69,15,70,15,2e,15,7a,15,69,15,70,\
  15,2e,15,73,15,43,15,52,41,00,21,15,57,15,6f,15,72,15,64,15,20,15,58,15,50,\
  15,2e,15,7a,15,69,15,70,15,2e,15,73,15,43,15,52,41,00,1b,15,57,15,6f,15,72,\
  15,64,15,2e,15,7a,15,69,15,70,15,2e,15,73,15,43,15,52,41,00,0f,15,30,15,34,\
  15,2e,15,70,15,69,15,66,41,00,1d,15,44,15,53,15,43,15,2d,15,30,15,30,15,34,\
  15,36,15,35,15,2e,15,50,15,69,15,66,41,00,1d,15,44,15,53,15,43,15,2d,15,30,\
  15,30,15,34,15,36,15,35,15,2e,15,70,15,49,15,66,41,00,19,15,69,15,6d,15,61,\
  15,67,15,65,15,30,15,34,15,2e,15,70,15,69,15,66,42,03,94,42,03,9a,00,28,00,\
  00,00,01,00,00,00,00,00,00,00,00,00,49,00,1a,40,c9,00,30,02,01,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Blackmal / Nyxem / KamaSutra\RegEx]
"15"="/reg_pass-data.zip/"
"2"="/./"
"1"="/ntps1-1.uni-erlangen.de/"
"3"="/time.mit.edu/"
"4"="/ntps1-1.uni-erlangen.de/"
"5"="/tick.greyware.com/"
"6"="/tock.keso.fi/"
"7"="/ntp2c.mcc.ac.uk/"
"8"="/ntp1.theremailer.net/"
"9"="/time.chu.nrc.ca/"
"10"="/time-a.timefreq.bldrdoc.gov/"
"11"="/time.nrc.ca/"
"12"="/ntp.massayonet.com.br/"
"13"="/ntp2b.mcc.ac.uk/"
"14"="/ntp2.ien.it/"
"26"="/time.ien.it/"
"25"="/clock.psu.edu/"
"24"="/swisstime.ethz.ch/"
"23"="/nist1.datum.com/"
"16"="/reg_pass.zip/"
"17"="/question_list.zip/"
"18"="/mailtext.zip/"
"19"="/mail_body.zip/"
"20"="/mail.zip/"
"21"="/list.zip/"
"22"="/email_text.zip/"
"27"="/ptbtime2.ptb.de/"
"28"="/Rolex.PeachNet.edu/"
"29"="/ntp.metas.ch/"
"30"="/ntp3.fau.de/"
"31"="/utcnist.colorado.edu/"
"38"="(\\.b64|\\.BHx|\\.HQX|\\.mim|\\.uu|\\.UU|\\.XxE)"
"37"="(392315089702606E-02|Clipe|Miss|Photos|Sweet_09)"
"36"="(3\\.92315089702606E02\\.UUE|Attachments[001]\\.B64|Attachments00\\.HQX|Attachments001\\.BHX|eBook\\.Uu|Original Message\\.B64|Sex\\.mim|SeX\\.mim|Video_part\\.mim|WinZip\\.BHX|Word_Document\\.hqx|Word_Document\\.uu)"
"35"="(007\\.pif|392315089702606E-02,\\.scR|677\\.pif|Adults_9,zip\\.sCR|Arab sex DSC-00465\\.jpg|ATT01\\.zip\\.sCR|Attachments[001],B64\\.sCr|Clipe,zip\\.sCr|document\\.pif|DSC-00465\\.Pif|DSC-00465\\.pIf|eBook\\.pdf|eBook\\.PIF|image04\\.pif|New Video,zip|New_Document_file\\.pif|photo\\.pif|Photos,zip\\.sCR|School\\.pif|SeX,zip\\.scR|Sex\\.mim|Video_part\\.mim|WinZip,zip\\.scR|WinZip\\.BHX|WinZip\\.zip\\.sCR|Word XP\\.zip\\.sCR|Word\\.zip\\.sCR|04\\.pif|DSC-00465\\.Pif|DSC-00465\\.pIf|image04\\.pif)"
"34"="(Note: forwarded message attached. You Must View This Videoclip!|>> forwarded message|Re: Sex Video|i just any one see my photos.|It's Free :\\)|The Best Videoclip Ever|Hot XXX Yahoo Groups|Fuckin Kama Sutra pics|ready to be FUCKED ;|forwarded message attached\\.|VIDEOS! FREE! \\(US$ 0,00\\)|What?|i send the file\\.|Helloi attached the details\\.|Thank you|the file i send the details|Please see the file\\.|how are you?|i send the details\\.)"
"33"="(Hot Movie|A Great Video|Fw: DSC-00465.jpg|Fw: Funny :|Fw: Picturs|Fw: Real show|Fw: SeX.mpg|Fw: Sexy|Fwd: Crazy illegal Sex!|Fwd: image.jpg|Fwd: Photo|give me a kiss|Miss Lebanon 2006|Part 1 of 6 Video clipeSchool girl fantasies gone bad)"
"32"="/sundial.columbia.edu/"

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]