1. A computer-readable storage device containing computer-executable instructions to control a computing device to analyze effects a malware infection by a method comprising: receiving post-infection snapshots from a plurality of machines suspected of being infected with malware, the post-infection snapshots identifying monitored activities of machines suspected of being infected with malware subsequent to the machines being suspected of being infected with malware; comparing the monitored activities of the post-infection snapshots to identify monitored activities that are common across multiple post-infection snapshots; and tagging as being possibly being caused by the malware infection the monitored activities that are common across multiple post-infection snapshots.