REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Unsafe Email Attachments]
"szFolder"="Virus Filters"
"szDescr"="Looks for email attatchments with potentially unsafe file extensions such as: ade, asf, bat, cli, cmd, com, diz, dll, dot, eml, exe, hsq, hta, js, jse, lnk, msi, msp, nws, ocx, pif, pl, pm pot, reg, rtf, scr, shs, sys, vb, vbe, vbs, vcf, vxd, wmd, wmf, wm"
"RGBValue"=dword:00800080
"dwVersion"=dword:00000000
"bDeleted"=dword:00000000
"FilterBuffer"=hex:62,04,00,00,01,00,00,00,5a,04,00,00,00,00,1f,00,00,f8,00,00,\
  00,00,01,00,06,00,02,00,00,dc,05,03,0c,01,00,35,04,00,00,0c,01,00,00,00,00,\
  45,52,43,50,35,04,00,00,00,00,00,64,00,00,00,00,0d,00,00,00,2f,00,3b,02,28,\
  00,03,00,00,00,00,00,00,00,00,00,00,00,00,00,50,04,07,51,04,01,15,2f,15,66,\
  15,69,15,6c,15,65,15,6e,15,61,15,6d,15,65,2a,08,15,3d,2a,08,2b,0b,15,2e,45,\
  00,24,3b,00,00,00,00,00,00,00,00,00,00,00,00,3e,f7,cd,01,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,42,00,24,52,00,54,15,61,53,00,26,15,64,3b,00,\
  00,00,00,00,00,00,00,00,00,00,00,20,00,01,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,41,00,26,15,73,3b,00,00,00,00,00,00,00,00,00,00,00,00,50,\
  00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,42,00,4c,41,00,43,\
  15,63,54,00,26,3b,00,00,00,00,00,00,00,00,00,00,00,00,00,81,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,15,6d,41,00,07,15,6c,15,69,41,00,07,\
  15,6d,15,64,41,00,07,15,70,15,70,42,00,3b,41,00,1d,15,64,55,00,07,15,69,15,\
  7a,41,00,07,15,6c,15,6c,41,00,07,15,6f,15,74,42,00,15,41,00,35,15,65,56,00,\
  26,15,6d,3b,00,00,00,00,00,00,00,00,00,00,00,00,40,10,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,41,00,07,15,78,15,65,42,00,2d,41,00,1d,15,\
  68,57,00,07,15,6c,15,70,41,00,07,15,73,15,71,41,00,07,15,74,15,61,42,00,15,\
  41,00,09,15,6a,15,73,1c,65,41,00,54,15,6d,58,00,26,15,64,3b,00,00,00,00,00,\
  00,00,00,00,00,00,00,26,00,80,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,41,00,26,15,73,3b,00,00,00,00,00,00,00,00,00,00,00,00,00,02,01,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,42,00,4c,41,00,60,15,70,59,00,\
  26,15,70,3b,00,00,00,00,00,00,00,00,00,00,00,00,00,00,18,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,41,00,07,15,69,15,66,41,00,24,3b,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,30,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,41,00,07,15,6f,15,74,42,00,58,41,00,16,15,72,5a,00,07,15,65,15,\
  67,41,00,07,15,74,15,66,42,00,0e,41,00,3c,15,73,5b,00,07,15,63,15,72,41,00,\
  26,3b,00,00,00,00,00,00,00,00,00,00,00,00,00,01,00,02,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,15,73,41,00,07,15,77,15,66,42,00,34,41,00,3d,15,\
  76,5c,00,27,15,62,3b,00,00,00,00,00,00,00,00,00,00,00,00,20,00,08,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,37,41,00,07,15,63,15,66,41,00,07,\
  15,78,15,64,42,00,35,41,00,7a,15,77,5d,00,26,15,6d,3b,00,00,00,00,00,00,00,\
  00,00,00,00,00,50,00,08,04,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  41,00,26,15,70,3b,00,00,00,00,00,00,00,00,00,00,00,00,10,20,08,04,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,41,00,26,15,73,3b,00,00,00,00,00,00,\
  00,00,00,00,00,00,48,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,42,00,72,41,00,28,15,78,15,6c,3b,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,90,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,41,00,09,15,62,15,\
  61,15,74,41,00,09,15,69,15,6e,15,69,41,00,09,15,6c,15,6e,15,6b,41,00,09,15,\
  6e,15,77,15,73,41,00,09,15,6f,15,63,15,78,42,03,21,3b,00,36,00,00,85,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  15,2f,15,69,15,52,15,22,15,3b,15,20,15,63,15,6c,15,61,15,73,15,73,15,74,15,\
  79,15,70,15,65,15,3a,15,73,15,75,15,73,15,70,15,69,15,63,15,69,15,6f,15,75,\
  15,73,15,2d,15,66,15,69,15,6c,15,65,15,6e,15,61,15,6d,15,65,15,2d,15,64,15,\
  65,15,74,15,65,15,63,15,74,15,3b,15,20,15,73,15,69,15,64,15,3a,15,37,15,32,\
  15,31,15,3b,15,20,15,72,15,65,15,76,15,3a,15,38,15,3b,42,04,01,42,04,07,00,\
  00,00
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Unsafe Email Attachments\RegEx]
"1"="(/filename\\s*=\\s*.*?\\.(?=[abcdehijlmnoprsvwx])(a(d[ep]|s[dfx])|c([ho]m|li|md|pp)|d(iz|ll|ot)|e(m[fl]|xe)|h(lp|sq|ta)|jse?|m(d[abew]|s[ip])|p(p[st]|if|[lm]|ot)|r(eg|tf)|s(cr|[hy]s|wf)|v(b[es]?|cf|xd)|w(m[dfsz]|p[dmsz]|s[cfh])|xl[tw]|bat|ini|lnk|nws|ocx)[\\x27\\x22\\n\\r\\s]/iR\"; classtype:suspicious-filename-detect; sid:721; rev:8;)"

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]