REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Downadup/Conflicter]
"szFolder"="Virus Filters"
"szDescr"="The sending machine may be infected with the Downadup worm. Detects the worm attempting to contact different servers to download or upload information."
"RGBValue"=dword:00800080
"dwVersion"=dword:00000000
"bDeleted"=dword:00000000
"FilterBuffer"=hex:49,01,00,00,06,00,00,00,17,00,74,00,1f,00,20,00,00,5c,00,06,\
  00,50,00,00,00,00,00,00,00,00,00,55,00,8b,00,00,00,1f,00,00,f9,31,00,01,00,\
  01,00,06,00,11,00,00,00,00,00,22,47,45,54,20,2f,64,6f,77,6e,6c,6f,61,64,2f,\
  67,65,6f,69,70,2f,64,61,74,61,62,61,73,65,2f,47,65,6f,49,50,01,00,06,00,12,\
  00,00,dc,05,00,0f,77,77,77,2e,6d,61,78,6d,69,6e,64,2e,63,6f,6d,17,00,00,00,\
  de,00,20,00,00,2b,00,11,00,35,00,00,00,00,00,00,00,00,00,53,00,00,00,00,00,\
  1f,00,00,a7,2a,00,01,00,01,00,06,00,11,00,00,00,00,00,1b,47,45,54,20,2f,34,\
  76,69,72,2f,61,6e,74,69,73,70,79,77,61,72,65,2f,6c,6f,61,64,61,01,00,06,00,\
  12,00,00,dc,05,00,14,74,72,61,66,66,69,63,63,6f,6e,76,65,72,74,65,72,2e,62,\
  69,7a,43,00,21,01,00,00,1f,00,00,c6,21,00,02,00,01,00,07,00,12,00,00,f4,01,\
  00,12,63,68,65,63,6b,69,70,2e,64,79,6e,64,6e,73,2e,6f,72,67,01,00,07,00,12,\
  00,00,f4,01,00,0d,67,65,74,6d,79,69,70,2e,63,6f,2e,75,6b,28,00,00,00,00,00,\
  1f,00,00,20,00,00,00,00,01,00,07,00,12,00,00,f4,01,00,0f,77,77,77,2e,67,65,\
  74,6d,79,69,70,2e,6f,72,67

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]