What most viruses do
----------------------------
End the svchost.exe process which is the Remote Procedure Call service. Under services.msc, if the policy is set to "Restart the Computer" under the unexpected service termination category, Windows will restart when the virus/user ends the process.
Ways to stop it include modifying the services.msc properties for the RPC Service and setting the policy to "Restart the Service" instead, or simply lenghtening the restart time (which is default 60 seconds) and its maximum is around a few hours or?
For third party programs which shut down the PC within a specified amount of time, the only way to solve it is Shutdown.exe -a or end the third party program completely.