REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Kongo.w]
"FilterBuffer"=hex:4e,01,00,00,0c,00,00,00,12,00,1a,00,00,00,01,00,10,74,00,00,\
  42,5a,41,fc,00,00,1c,00,36,00,00,00,35,00,50,30,00,00,d5,db,d8,32,00,00,00,\
  00,00,00,00,00,00,00,00,00,1c,00,52,00,00,00,35,00,50,06,00,00,cd,d1,b8,b4,\
  00,00,00,00,00,00,00,00,00,00,00,00,1c,00,6e,00,00,00,35,00,50,c7,00,00,d5,\
  84,c4,cd,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,8a,00,00,00,35,00,50,4d,\
  00,00,d4,f8,15,64,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,a6,00,00,00,35,\
  00,50,b7,00,00,45,14,68,03,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,c2,00,\
  00,00,35,00,50,0d,00,00,c2,87,1e,c0,00,00,00,00,00,00,00,00,00,00,00,00,1c,\
  00,de,00,00,00,35,00,50,08,00,00,d5,1c,fe,3c,00,00,00,00,00,00,00,00,00,00,\
  00,00,1c,00,fa,00,00,00,35,00,50,1c,00,00,d1,19,d5,3a,00,00,00,00,00,00,00,\
  00,00,00,00,00,1c,00,16,01,00,00,35,00,50,ab,00,00,c3,16,a1,45,00,00,00,00,\
  00,00,00,00,00,00,00,00,1c,00,32,01,00,00,35,00,50,a3,00,00,d9,90,61,a2,00,\
  00,00,00,00,00,00,00,00,00,00,00,1c,00,00,00,00,00,35,00,50,85,00,00,d4,18,\
  3f,41,00,00,00,00,00,00,00,00,00,00,00,00
"szDescr"="The sending machine may be infected with the Kongo.w virus."
"RGBValue"=dword:00800080
"szFolder"="Virus Filters"
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]