1. A computer-readable memory storing computer-executable instructions for controlling a computing device to analyze a malware infection, the computer-executable instructions comprising instructions that: receive pre-infection snapshots from a plurality of machines suspected of being infected with malware, the pre-infection snapshots identifying monitored activities that were conducted at machines suspected of being infected with malware prior to the machine being suspected of being infected with malware; and compare the monitored activities of the pre-infection snapshots to identify monitored activities that are common across multiple pre-infection snapshots.