REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Sasser Worm]
"FilterBuffer"=hex:76,00,00,00,04,00,00,00,17,00,3f,00,1f,00,1e,00,00,a2,00,06,\
  00,0c,27,00,00,00,00,00,00,00,00,20,00,00,00,00,00,1f,00,00,06,00,00,00,00,\
  01,00,06,00,02,00,00,b0,04,01,07,5f,75,70,2e,65,78,65,17,00,00,00,56,00,1e,\
  00,00,f6,00,06,00,b2,15,00,00,00,00,00,00,00,00,20,00,00,00,00,00,1f,00,00,\
  b5,00,00,00,00,01,00,06,00,02,00,00,b0,04,01,07,5f,75,70,2e,65,78,65
"szDescr"="This filter captures the Sasser Worm sending its data to another machine in order to infect the other system. The sending station is already infected."
"RGBValue"=dword:00800080
"szFolder"="Virus Filters"

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]