1. A method in a computer system for performing cause and effect analysis of a malware infection, the method comprising: monitoring a plurality of activities on a computer system; recording the monitored activities; upon receiving a notification of a suspected malware infection, creating a pre-infection snapshot, the pre-infection snapshot containing the monitored activities that were conducted within a time frame prior to the notification of the suspected malware infection; and providing the pre-infection snapshot for analysis.