1. A method in a computer system for performing cause and effect analysis of a malware infection, the method comprising: monitoring a plurality of activities on a first computer system; recording the monitored activities; upon receiving a notification of a suspected malware infection, creating a first pre-infection snapshot by storing an indication of recorded monitored activities as the first pre-infection snapshot, the first pre-infection snapshot indicating the monitored activities that were conducted within a time frame prior to the notification of the suspected malware infection; receiving second pre-infection snapshots from second computer systems, the second pre-infection snapshot for a second computer system being created by storing an indication of recorded monitored activities of the second computer system that were conducted within a time frame prior to that second computer system receiving a notification of the suspected malware infection; analyzing the first pre-infection snapshot by comparing the monitored activities of the first pre-infection snapshot to the monitored activities of second pre-infection snapshots of second computer systems to identify common activities represented by the first pre-infection snapshot and the second pre-infection snapshots that are similar across the first pre-infection snapshot and the second pre-infection snapshots; and generating a recommendation for processing the suspected malware infection based on the identified common activities, wherein the first computer system and the second computer systems are on different machines.