REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) BugBear.b]
"FilterBuffer"=hex:5c,00,00,00,02,00,00,00,2a,00,32,00,00,00,1f,00,00,f1,12,00,\
  01,00,00,00,01,00,01,50,00,00,00,01,03,5c,57,49,00,00,01,00,01,59,00,00,00,\
  01,03,4e,4f,54,2a,00,00,00,00,00,1f,00,00,69,12,00,01,00,00,00,01,00,01,50,\
  00,00,00,01,03,5c,50,52,00,00,01,00,01,5f,00,00,00,01,03,57,49,4e
"szDescr"="The offending station may have been infected with the W32.BugBear.B virus."
"RGBValue"=dword:00800080
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]