What most viruses do
----------------------------
End the svchost.exe process which is the Remote Procedure Call
service. Under services.msc, if the policy is set to "Restart the
Computer" under the unexpected service termination category,
Windows will restart when the virus/user ends the process.
Ways to stop it include modifying the services.msc properties for
the RPC Service and setting the policy to "Restart the Service"
instead, or simply lenghtening the restart time (which is default
60 seconds) and its maximum is around a few hours or? 
For third party programs which shut down the PC within a specified
amount of time, the only way to solve it is Shutdown.exe -a or end
the third party program completely.
