PC Hell: How to Remove Sysupd.exe (TSCash)

According to Spybot Search and Destroy, PestPatrol, and other spyware removal tools on the web, TSCash is a German dialer program that surfaced around April 2001. The original website www.tscash.de appears to be dormant at the moment, although the files from this dialer, especially sysupd.exe, appear to be making a comeback in the form of spyware across the web. Originally the program was a German dialer that disconnected your internet connection and reconnected at a rate from 1.86 Euros per minute to 3.63 Euros per minute or more.

Currently, it appears the program may slow internet connections more than anything, however its better to be safe and rid your system of this spyware in case it does more.

I'll give you two methods of removing this pest. The first is a quick, specific method for removing the annoying sysupd.exe file from your system, while the second method covers the entire TSCash dialer and all known files.

1) Because the file is very persistent and reopens even after stopping the process from Task Manager, you'll need to start your computer in Safe Mode to begin with.

2) Once in Safe Mode, click on Start, Run, and type REGEDIT and press Enter to open the Registry Editor

7) Restart your computer and open Task Manager, SYSUPD should no longer be there

1) Because the file is very persistent and reopens even after stopping the process from Task Manager, you'll need to start your computer in Safe Mode to begin with.

2) Once in Safe Mode, click on Start, Run, and type REGEDIT and press Enter to open the Registry Editor

4) In the right-hand column, highlight and delete the entries for SYSUPD or TSTIME

HKEY_CLASSES_ROOT\clsid\{13258718-b804-4092-8496-55f80aedbf1f}
HKEY_CLASSES_ROOT\tsplugin.tscplugin
HKEY_CLASSES_ROOT\tsplugin.tscplugin.1
HKEY_LOCAL_MACHINE\software\classes\clsid\{13258718-b804-4092-8496-55f80aedbf1f}
HKEY_LOCAL_MACHINE\software\classes\tsplugin.tscplugin
HKEY_LOCAL_MACHINE\software\classes\tsplugin.tscplugin.1
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{13258718-b804-4092-8496-55f80aedbf1f}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/tsplugin.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/system32/sysupd.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/system32/tscore.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/system32/tstime.exe

8) Restart your computer and check with Spybot or other spyware removal software to make sure the program is gone.