1. A computer-implemented method for detecting malware on a computer system, comprising: detecting a window created by a process running on the computer system; determining whether the window may be a fake anti-malware user interface (UI) based on whether the window comprises a scan dialog including a scan progress bar indicating that a file scan is in progress; responsive to determining that the window may be a fake anti-malware UI, determining whether information displayed in the window is valid by determining whether the indicated file scan is in progress; and responsive to a determination that the information displayed in the window is invalid, classifying the process as malware and applying a remediating action to the process.