REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Esbot.A]
"szFolder"="Virus Filters"
"szDescr"="the sending machine may be infected with the esbot.a virus."
"RGBValue"=dword:00800080
"dwVersion"=dword:00000000
"bDeleted"=dword:00000000
"FilterBuffer"=hex:65,00,00,00,02,00,00,00,17,00,00,00,1f,00,1e,00,00,06,00,06,\
  00,93,46,00,00,00,00,00,00,00,00,46,00,00,00,00,00,1f,00,00,ea,21,00,02,00,\
  01,00,06,00,01,00,00,00,00,00,12,3a,65,73,78,74,2e,69,73,2d,61,2d,66,61,67,\
  2e,6e,65,74,01,00,06,00,01,00,00,00,00,00,10,3a,65,73,78,74,2e,6c,65,67,69,\
  30,6e,2e,6e,65,74
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]