1. A computer security method comprising: identifying, by one or more processors, a memory location within a memory of a computer for monitoring responsive to a removal of a malicious patch affecting the memory location; adding, by the one or more processors, the memory location to a list of memory locations to be monitored for subsequent attempts to modify write-protection attributes of the respective memory locations; detecting, by the one or more processors, a request to modify a write-protection attribute of the memory location, wherein the request seeks to allow the memory location to be written to and denying, by the one or more processors, the request to modify the write-protected attribute of the memory location.