REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Grum.A]
"szFolder"="Virus Filters"
"szDescr"="Captured packets may be receiving or sending  or infected with the GRUM.A virus"
"RGBValue"=dword:00800080
"dwVersion"=dword:00000000
"bDeleted"=dword:00000000
"FilterBuffer"=hex:9c,00,00,00,04,00,00,00,17,00,73,00,1f,00,20,00,00,c8,00,06,\
  00,19,00,00,00,00,00,00,00,00,00,54,00,00,00,00,00,1f,00,00,80,2c,00,01,00,\
  01,00,06,00,02,00,00,dc,05,00,1d,49,6e,74,65,72,6e,65,74,20,45,78,70,6c,6f,\
  72,65,72,20,37,20,44,6f,77,6e,6c,6f,61,64,73,00,00,01,00,02,00,00,dc,05,00,\
  13,61,64,6d,69,6e,40,6d,69,63,72,6f,73,6f,66,74,2e,63,6f,6d,17,00,8a,00,1f,\
  00,20,00,00,3b,00,06,00,6e,00,00,00,00,00,00,00,00,00,12,00,00,00,00,00,01,\
  00,10,f6,00,00,42,e8,7e,8a,00,00
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]