Why does my PC keep rebooting with the message "This system is being shut down in 60 seconds by NT Authority/System due to an interrupted Remote Procedure Call (RPC)"?

A. The error you've encountered is a symptom of the MSBlast worm (also known as the W32.Blaster.Worm), which has been around since August 2003. To resolve this error, you first need to use the command

shutdown -a

to stop the system from shutting down so that you can patch the computer and remove the virus. Next, download and install the patch, which is available on Microsoft's Web site.

To remove running versions of the virus from your PC, open Task Manager, select the Processes tab, then click End Process for all of the following processes:


To prevent the virus from starting again, perform the following steps:

  1. Start a registry editor (e.g., regedit.exe).
  2. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry subkey.
  3. Remove any value that mentions any of the executables listed above.
  4. Close the registry editor.
  5. Open Windows Explorer, search your Windows folder for any of the executables listed above, then remove those files.
  6. If you're running Windows XP, enable the Internet Connection Firewall (ICF) and use Windows Update to keep your system up-to-date.

An automated virus removal tool that replaces the steps above is available at the Symantec Web site. (If you use this tool, you'll still need to download and install the patch from the Microsoft Web site.)

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.