1. A computer-readable memory storing computer-executable instructions for controlling a computing device to analyze a malware infection, the computer-executable instructions comprising instructions that: receive a pre-infection snapshot from each of a plurality of machines suspected of being infected with malware, the pre-infection snapshots identifying monitored activities that were conducted at machines suspected of being infected with malware prior to the machine being suspected of being infected with malware; compare the monitored activities of the pre-infection snapshots of each of the plurality of machines to the monitored activities of the pre-infection snapshots of other machines to identify monitored activities that are common across multiple machines; and automatically re-configure security policies of the plurality of machines based on analysis of the monitored activities that are common to prevent a future infection caused by malware.