REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) W32_SoBig.f]
"FilterBuffer"=hex:47,03,00,00,29,00,00,00,17,00,31,00,1f,00,1e,00,00,23,02,11,\
  00,7b,00,00,00,00,00,00,00,00,00,12,00,48,00,00,00,01,00,50,4b,00,00,83,bc,\
  03,de,00,00,17,00,8c,01,7a,01,1e,00,00,54,02,11,00,26,23,00,00,00,00,00,00,\
  00,00,12,00,5a,00,00,00,01,00,50,a5,00,00,81,84,02,15,00,00,12,00,6c,00,00,\
  00,01,00,50,6c,00,00,89,5c,8c,50,00,00,12,00,7e,00,00,00,01,00,50,3e,00,00,\
  c8,13,77,45,00,00,12,00,90,00,00,00,01,00,50,0d,00,00,8e,03,64,02,00,00,12,\
  00,a2,00,00,00,01,00,50,d3,00,00,80,e9,03,65,00,00,12,00,b4,00,00,00,01,00,\
  50,a4,00,00,d4,f2,56,ba,00,00,12,00,c6,00,00,00,01,00,50,59,00,00,8a,60,40,\
  0a,00,00,12,00,d8,00,00,00,01,00,50,fc,00,00,c1,f0,72,e8,00,00,12,00,ea,00,\
  00,00,01,00,50,ce,00,00,85,64,0b,08,00,00,12,00,fc,00,00,00,01,00,50,90,00,\
  00,c1,43,4f,ca,00,00,12,00,0e,01,00,00,01,00,50,69,00,00,c1,05,d8,0e,00,00,\
  12,00,20,01,00,00,01,00,50,47,00,00,83,bc,03,de,00,00,12,00,32,01,00,00,01,\
  00,50,24,00,00,c1,4f,ed,0e,00,00,12,00,44,01,00,00,01,00,50,ff,00,00,84,b5,\
  0c,0d,00,00,12,00,56,01,00,00,01,00,50,7b,00,00,c8,44,3c,f6,00,00,12,00,68,\
  01,00,00,01,00,50,a2,00,00,3e,77,28,62,00,00,12,00,00,00,00,00,01,00,50,d7,\
  00,00,96,fe,b7,0f,00,00,12,00,f1,01,00,00,01,00,50,a3,00,00,0c,9e,66,cd,00,\
  00,65,00,00,00,00,00,1f,00,00,22,00,00,00,00,01,00,06,00,01,00,00,00,00,00,\
  4c,56,44,76,64,4b,63,59,57,7a,6e,52,62,4c,52,50,61,64,51,2b,56,35,37,36,59,\
  55,73,36,46,77,42,47,47,72,59,6e,72,37,63,71,59,6c,4c,49,39,2f,39,7a,77,72,\
  66,65,39,54,30,74,4d,62,46,54,64,58,32,47,6d,51,66,6f,37,54,72,63,45,43,69,\
  39,41,12,00,03,02,00,00,01,00,50,fd,00,00,41,5d,51,3b,00,00,12,00,15,02,00,\
  00,01,00,50,d2,00,00,18,d2,b6,9c,00,00,12,00,27,02,00,00,01,00,50,4e,00,00,\
  44,32,d0,60,00,00,12,00,39,02,00,00,01,00,50,c0,00,00,41,5c,50,da,00,00,12,\
  00,4b,02,00,00,01,00,50,89,00,00,18,ce,4b,89,00,00,12,00,5d,02,00,00,01,00,\
  50,11,00,00,3f,26,9f,a1,00,00,12,00,6f,02,00,00,01,00,50,c6,00,00,41,5c,ba,\
  91,00,00,12,00,81,02,00,00,01,00,50,7a,00,00,18,ca,5b,2b,00,00,12,00,93,02,\
  00,00,01,00,50,5d,00,00,43,09,f1,43,00,00,12,00,a5,02,00,00,01,00,50,25,00,\
  00,41,b1,f0,c2,00,00,12,00,b7,02,00,00,01,00,50,f3,00,00,18,c5,8f,84,00,00,\
  12,00,c9,02,00,00,01,00,50,97,00,00,43,49,15,06,00,00,12,00,db,02,00,00,01,\
  00,50,5c,00,00,3f,fa,52,57,00,00,12,00,ed,02,00,00,01,00,50,2c,00,00,da,93,\
  a4,1d,00,00,12,00,ff,02,00,00,01,00,50,b2,00,00,42,83,cf,51,00,00,12,00,11,\
  03,00,00,01,00,50,0a,00,00,3d,26,bb,3b,00,00,12,00,23,03,00,00,01,00,50,53,\
  00,00,0c,e8,68,dd,00,00,12,00,35,03,00,00,01,00,50,17,00,00,41,5f,c1,8a,00,\
  00,12,00,00,00,00,00,01,00,50,d0,00,00,18,21,42,26,00,00
"szDescr"="The sending station may have been infected with the W32.SoBig.F virus."
"RGBValue"=dword:00800080
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]