1. A computer-implemented method, comprising: monitoring, by a first computer, for attempts to disable a malware protection program; in response to monitoring an attempt to disable the malware protection program: identifying, by the first computer, a first process that generated the attempt to disable the malware protection program; preventing, by the first computer, the first process from disabling the malware protection program; determining, by the first computer, whether the first process is an approved process; in response to determining that the first process is an approved process, providing, by the first computer, a user prompt to terminate the first process; and in response to determining that the first process is not an approved process, performing, by the first computer, one or more protection processes on the first process.