1. A method comprising: at a server in a computing system, receiving meta-data extracted from files of interest from a plurality of client computers, wherein the files of interests are selected files of the plurality of client computers and have been identified based upon activity of the files including creating, moving, copying or executing the files, and wherein the meta-data includes contextual information of how each of the files of interests are identified; logging the files of interest and the extracted meta-data into log files; periodically scanning the log files to identify a subset of files as candidates for rescanning based on a vector of scores, wherein the vector of scores is determined at least in part based on the contextual information including whether a file was accessed after one or more known malicious or known clean files were accessed, whether a parent process that created the file is determined to be malicious or benign, whether there is system-level behavior that is indicative of malicious software running on the system, and whether prevalence of the file among multiple users exceeds a pre-defined threshold; and rescanning the identified candidates against information stored at the server to determine whether a previously assigned disposition needs to be changed.