1. A method comprising: accessing, by one or more computers, information about event logs that correspond to the event logs of a particular computing device and one or more computing devices; identifying a particular event from the accessed information; determining a hash value of a file or a process associated with the particular event; comparing the determined hash value with an expected hash value for the file or the process; comparing, by one or more computers, the accessed information for the particular event from the particular computing device with the accessed information for the particular event from the one or more computing devices; determining that the particular event is an unusual event based on results of comparing the accessed information for the particular event from the particular computing device with the accessed information for the particular event from the one or more computing devices and of comparing the determined hash value with an expected hash value for the file or the process; accessing, from a database, one or more risk factors for a malware attack on a computing device; comparing the unusual event against the accessed risk factors; determining, based on results of comparing the unusual event against the accessed risk factors, whether the unusual event satisfies at least one of the risk factors; and verifying whether the unusual event is the malware attack when at least one of the risk factors is satisfied.