((Image:\\odbcconf.exe OR OriginalFileName:odbcconf.exe) (CommandLine:\ \-f\ * OR CommandLine:\ \/f\ * OR CommandLine:\ –f\ * OR CommandLine:\ —f\ * OR CommandLine:\ ―f\ *)) (-(CommandLine:.rsp* OR (ParentImage:C\:\\Windows\\System32\\runonce.exe Image:C\:\\Windows\\System32\\odbcconf.exe CommandLine:.exe\ \/E\ \/F\ \"C\:\\WINDOWS\\system32\\odbcconf.tmp\"*)))