1. A computer-readable storage device containing computer-executable instructions for controlling a computing device to analyze a malware infection by a method comprising: receiving pre-infection snapshots from a plurality of machines suspected of being infected with malware, the pre-infection snapshots identifying monitored activities that were conducted at machines suspected of being infected with malware prior to the machine being suspected of being infected with malware; comparing the monitored activities of the pre-infection snapshots to identify monitored activities that are common across multiple pre-infection snapshots; and tagging as being suspicious at least some monitored activities that are common across multiple pre-infection snapshots.