.png?width=100&auto=webp&quality=80&disable=upscale "Picture of John Savill")
.png?width=400&auto=webp&quality=80&disable=upscale "John Savill")
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Why does my PC keep rebooting with the message "This system is being shut down in 60 seconds by NT Authority/System due to an interrupted Remote Procedure Call (RPC)"?
John Savill
September 21, 2003
1 Min Read
A. The error you've encountered is a symptom of the MSBlast worm (also known as the W32.Blaster.Worm), which has been around since August 2003. To resolve this error, you first need to use the command
shutdown -ato stop the system from shutting down so that you can patch the computer and remove the virus. Next, download and install the patch, which is available on Microsoft's Web site.
To remove running versions of the virus from your PC, open Task Manager, select the Processes tab, then click End Process for all of the following processes:
MSBLAST.EXE
PENIS32.EXE
TEEKIDS.EXE
MSPATCH.EXE
MSLAUGH.EXE
ENBIEI.EXE
To prevent the virus from starting again, perform the following steps:
Start a registry editor (e.g., regedit.exe).
Navigate to the HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun registry subkey.
Remove any value that mentions any of the executables listed above.
Close the registry editor.
Open Windows Explorer, search your Windows folder for any of the executables listed above, then remove those files.
If you're running Windows XP, enable the Internet Connection Firewall (ICF) and use Windows Update to keep your system up-to-date.
An automated virus removal tool that replaces the steps above is available at the Symantec Web site. (If you use this tool, you'll still need to download and install the patch from the Microsoft Web site.)
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
