REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Zafi.B / Erkez.B]
"FilterBuffer"=hex:45,04,00,00,16,00,00,00,12,00,31,00,1a,00,01,00,10,66,00,00,\
  c1,e0,1c,03,00,00,17,00,00,00,4d,00,20,00,00,a0,00,06,00,50,00,00,00,00,00,\
  00,00,00,00,1c,00,6a,00,1a,00,35,00,50,fb,00,00,d4,6c,c5,7c,00,00,00,00,00,\
  00,00,00,00,00,00,00,1d,00,00,00,00,00,1f,00,00,f8,00,00,00,00,01,00,06,00,\
  01,00,00,00,00,00,04,2f,47,45,54,1c,00,86,00,1a,00,35,00,50,29,00,00,c3,46,\
  23,de,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,a2,00,1a,00,35,00,50,4f,00,\
  00,c3,46,30,f5,00,00,00,00,00,00,00,00,00,00,00,00,17,00,00,00,b9,00,20,00,\
  00,cd,00,06,00,19,00,00,00,00,00,00,00,00,00,5a,00,13,01,00,00,1f,00,00,61,\
  00,00,00,00,01,00,06,00,02,00,00,78,05,00,41,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,\
  2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,20,68,69,72,64,65,74,3d,45,39,73,\
  20,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,2d,\
  2d,2d,2d,2d,2d,51,00,64,01,00,00,1f,00,00,c4,00,00,00,00,01,00,06,00,02,00,\
  00,78,05,00,38,48,61,6c,6c,6f,21,20,0d,0a,68,61,74,20,64,69,72,20,65,69,6e,\
  65,20,65,6c,65,6b,74,72,6f,6e,69,73,63,68,65,20,46,6c,61,73,68,63,61,72,64,\
  20,67,65,73,63,68,69,63,6b,74,2e,2d,00,91,01,00,00,1f,00,00,d8,00,00,00,00,\
  01,00,06,00,02,00,00,78,05,00,14,43,6f,6e,74,65,6e,74,3a,20,54,65,20,61,6d,\
  6f,2e,2e,2e,20,2c,2a,00,bb,01,00,00,1f,00,00,e2,00,00,00,00,01,00,06,00,02,\
  00,00,78,05,00,11,57,20,44,6e,69,75,20,69,6d,69,65,6e,69,6e,2e,2e,2e,2f,00,\
  ea,01,00,00,1f,00,00,ee,00,00,00,00,01,00,06,00,02,00,00,78,05,00,16,4c,69,\
  6e,6b,73,6d,6f,20,67,69,6d,74,61,64,69,65,6e,6f,21,20,68,61,27,00,11,02,00,\
  00,1f,00,00,f6,00,00,00,00,01,00,06,00,02,00,00,78,05,00,0e,49,6c,6f,69,73,\
  74,61,20,6b,65,73,61,61,21,40,00,51,02,00,00,1f,00,00,0d,00,00,00,00,01,00,\
  06,00,02,00,00,78,05,00,27,56,61,6b,72,65,20,72,6f,73,65,72,20,6a,65,67,20,\
  73,61,6d,6d,65,6e,6c,69,67,6e,65,72,20,6d,65,64,20,64,65,67,2e,2e,2e,44,00,\
  95,02,00,00,1f,00,00,13,00,00,00,00,01,00,06,00,02,00,00,78,05,00,2b,49,6e,\
  66,6f,72,6d,61,63,69,6f,6e,20,69,6d,70,6f,72,74,61,6e,74,65,20,71,75,65,20,\
  64,65,62,65,73,20,63,6f,6e,6f,63,65,72,2c,20,2d,33,00,c8,02,00,00,1f,00,00,\
  18,00,00,00,00,01,00,06,00,02,00,00,78,05,00,1a,4d,69,74,20,68,6a,65,72,74,\
  65,20,62,61,6e,6b,65,72,20,66,6f,72,20,64,69,67,21,4a,00,12,03,00,00,1f,00,\
  00,1f,00,00,00,00,01,00,06,00,02,00,00,78,05,00,31,44,65,20,63,61,6e,64,20,\
  74,65,2d,61,6d,20,63,75,6e,6f,73,63,75,74,20,69,6e,69,6d,61,20,6d,65,61,20,\
  61,72,65,20,75,6e,20,6e,6f,75,20,72,69,74,6d,21,66,00,78,03,00,00,1f,00,00,\
  fc,3f,00,02,00,01,00,06,00,02,00,00,78,05,00,30,54,69,73,7a,74,65,6c,74,20,\
  66,65,6c,68,61,73,7a,6e,e1,6c,3f,0d,0a,d6,6e,6e,65,6b,20,6b,f3,70,65,73,6c,\
  61,70,6a,61,20,f3,72,6b,65,7a,65,74,74,21,01,00,06,00,02,00,00,78,05,00,12,\
  6b,65,70,65,73,6c,61,70,20,65,72,6b,65,7a,65,74,74,21,2c,00,a4,03,00,00,1f,\
  00,00,26,00,00,00,00,01,00,06,00,02,00,00,78,05,00,13,54,69,6c,6c,20,6d,69,\
  6e,20,41,6c,73,6b,61,64,65,2e,2e,2e,22,00,c6,03,00,00,1f,00,00,8b,00,00,00,\
  00,01,00,06,00,02,00,00,78,05,00,09,57,48,41,54,53,4e,45,57,21,2e,00,f4,03,\
  00,00,1f,00,00,67,00,00,00,00,01,00,06,00,02,00,00,78,05,00,15,43,68,65,63,\
  6b,20,74,68,69,73,20,6f,75,74,20,6b,69,64,21,21,21,51,00,00,00,00,00,1f,00,\
  00,b5,00,00,00,00,01,00,06,00,01,00,00,00,00,00,38,59,6f,75,27,76,65,20,67,\
  6f,74,20,31,20,56,6f,69,63,65,4d,65,73,73,61,67,65,20,66,72,6f,6d,20,76,6f,\
  69,63,65,6d,65,73,73,61,67,65,2e,63,6f,6d,20,77,65,62,73,69,74,65,21
"szDescr"="The sending station may be infected with the Zafi.B / Erkez.B Virus."
"szFolder"="Virus Filters"
"RGBValue"=dword:00800080
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]