1. A computing system implemented process for detecting rogue security software comprising: defining a timeframe for monitoring a source process; determining, using one or more processors associated with one or more computing systems, a threshold pop-up score such that a source process having a pop-up score greater than the threshold pop-up score is considered a suspect source process; monitoring, using the one or more processors associated with the one or more computing systems, a user computing system to detect any pop-ups generated on the user computing system; detecting, using the one or more processors associated with the one or more computing systems, a pop-up generated on the user computing system; identifying, using the one or more processors associated with the one or more computing systems, a source process associated with the detected pop-up; monitoring, using the one or more processors associated with the one or more computing systems, the identified source process associated with the detected pop-up for at least the defined timeframe to determine a number of pop-up events on the user computing system in the defined timeframe associated with the identified source process, wherein a pop-up event that is minimized and later reopened by a user comprises one independent pop-up event; determining, using the one or more processors associated with the one or more computing systems, a pop-up score for the identified source process, the pop-up score for the identified source process being based, at least in part, on the determined number of pop-up events on the user computing system in the defined timeframe associated with the identified source process, the popup score further being based on a reputation and prevalence score associated with the identified source process, the reputation and prevalence score being representative of how well-known and wide-spread the identified source process is, wherein an unknown reputation and a low prevalence score causes the pop-up score to increase; comparing, using the one or more processors associated with the one or more computing systems, the pop-up score for the identified source process with the threshold pop-up score; and if the pop-up score for the identified source process is greater than the threshold pop-up score, using the one or more processors associated with the one or more computing systems to transform a status of the identified source process to a status of identified suspect source process.