REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Moo.b Trojan]
"FilterBuffer"=hex:36,00,00,00,02,00,00,00,12,00,1a,00,00,00,01,00,10,88,00,00,\
  c3,e1,b0,03,00,00,1c,00,00,00,00,00,35,00,50,a9,00,00,c3,e1,b1,0e,00,00,00,\
  00,00,00,00,00,00,00,00,00
"bFilterBasedAlarm"=dword:00000001
"szDescr"="This filter captures traffic going to specific machines that are used by the trojan to spread itself."
"RGBValue"=dword:00800080
"szFolder"="Virus Filters"

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]