Este codigo sirve para interceptar la funcion WM_QUERYENDSESSION que se produce en el sistema, este codigo es util para virus, y etc...

Primero lo que tendriamos de hacer es crear un modulo BAS:

Option Explicit
Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" ( _
    ByVal lpPrevWndFunc As Long, _
    ByVal Hwnd As Long, _
    ByVal MSG As Long, _
    ByVal wParam As Long, _
    ByVal lParam As Long) As Long
Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" ( _
    ByVal Hwnd As Long, _
    ByVal nIndex As Long, _
    ByVal dwNewLong As Long) As Long
Public Const GWL_WNDPROC = -4
Public Const WM_QUERYENDSESSION = &H11
Global Const WM_CANCELMODE = &H1F
Global lpPrevWndProc As Long
Public Sub Hook(Hwnd_Form As Long)
    lpPrevWndProc = SetWindowLong(Hwnd_Form, GWL_WNDPROC, AddressOf WindowProc)
End Sub
Public Sub Unhook(Hwnd_Form As Long)
    Dim ret As Long
    ret = SetWindowLong(Hwnd_Form, GWL_WNDPROC, lpPrevWndProc)
End Sub
Function WindowProc(ByVal Hwnd As Long, _
                    ByVal uMsg As Long, _
                    ByVal wParam As Long, _
                    ByVal lParam As Long) As Long
    If uMsg = WM_QUERYENDSESSION Then
        WindowProc = CallWindowProc(lpPrevWndProc, Hwnd, WM_CANCELMODE, wParam, wParam)
            MsgBox "WM_QUERYENDSESSION Interceptado", vbInformation, "WM_QUERYENDSESSION"
            Exit Function
    End If
    WindowProc = CallWindowProc(lpPrevWndProc, Hwnd, uMsg, wParam, lParam)
End Function
Luego creamos el formulario:

Option Explicit
Private Sub Form_Load()
    Hook Me.Hwnd
End Sub
Private Sub Form_Unload(Cancel As Integer)
    Unhook Me.Hwnd
End Sub