1. A computer-implemented method, comprising: installing a particular code hook on a computing system, wherein the computing system comprises an operating system providing an execution environment and the computing system further comprises one or more programs to execute in the execution environment, the one or more programs include a malware protection program, and the particular code hook is installed using the malware protection program and is configured to intercept application programming interface (API) calls to the operating system; detecting that a particular one of the calls, intercepted by the particular code hook, comprises an attempt to disable the malware protection program; identifying, using a first computer, a first process that generated the attempt to disable the malware protection program, wherein identifying the first process includes collecting identification data describing characteristics of the first process; preventing the first process from disabling the malware protection program, wherein the preventing includes blocking the attempt to disable the malware protection program; and determining, in response to blocking the attempt to disable the malware protection program, whether the first process is an approved process based at least in part on the collected identification data; wherein determining that the first process is an approved process causes a user prompt to be presented to provide a user an option to terminate the first process and determining that the first process is not an approved process causes one or more malware protection processes to be performed on the first process.