REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Lovesan]
"FilterBuffer"=hex:99,00,00,00,06,00,00,00,12,00,31,00,1a,00,23,00,00,5c,f2,03,\
  00,00,00,00,00,00,17,00,00,00,48,00,1e,00,00,03,02,06,00,87,00,00,00,00,00,\
  00,00,00,00,17,00,00,00,7d,00,1e,00,00,25,02,06,00,87,00,00,00,00,00,00,00,\
  00,00,1b,00,00,00,63,00,1f,00,00,44,00,00,00,00,00,00,01,00,01,4c,00,00,00,\
  01,02,04,00,1a,00,00,00,00,00,1f,00,01,5e,00,00,00,00,00,00,01,00,02,87,05,\
  95,05,01,01,00,1c,00,00,00,00,00,1f,00,00,7b,00,00,00,00,00,00,01,00,01,ca,\
  03,00,00,01,03,90,90,90
"szDescr"="This event indicates that the sending machine may be infected with the MS Blaster (Lovesan) virus."
"RGBValue"=dword:00800080
"bFilterBasedAlarm"=dword:00000001
"szFolder"="Virus Filters"

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]