1. A computer implemented method for detecting malware based on program behaviors targeting load points of an operating system, the method comprising the steps of: monitoring behaviors of programs concerning operating system load points, by a computer, wherein the load points specify programs to be run upon start-up of the operating system; responsive to detecting a specific program writing a set value to a specific load point, the set value specifying a program to run upon start-up of the operating system, updating the set value at the load point to prevent the potential malware to run upon start-up of the operating system; detecting the specific program behavior of attempting to actively maintain a previously set value of the specific load point to run the program upon start-up of the operating system; responsive to the detected behavior, adjudicating that the specific program comprises malware, by the computer; and performing at least one action to protect the computer from the malware, responsive to adjudicating that the specific program comprises malware.