Got this from th syslog:

Code:
Nov  4 06:22:56 HTPC vdr: [1238] executing '/usr/lib/vdr/vdr-shutdown.wrapper 0 0 0 "" 0'
Nov  4 06:22:56 HTPC vdr: [1238] saved setup to /var/lib/vdr/setup.conf
Nov  4 06:22:56 HTPC vdr-shutdown: executing /usr/share/vdr/shutdown-hooks/S90.custom as shell script
Looks like the VDR server is initiating the shutdown command.. which makes sense because it is always running, even when XBMC is closed.