1. A computer-readable storage device containing computer-executable instructions for controlling a computing device to analyze a malware infection by a method comprising: receiving pre-infection snapshots from a plurality of machines suspected of being infected with malware, the pre-infection snapshot for a machine identifying monitored activities that were conducted at that machine prior to the machine being suspected of being infected with malware, each pre-infection snapshot for a machine being created by a program that monitors and records the activity of that machine; comparing the monitored activities of the pre-infection snapshots of multiple machines to identify monitored activities that are common across multiple pre-infection snapshots of different machines, wherein the monitored activities of a machine relate to accessing of an operating system resource of an operating system executing on the machine; and tagging as being suspicious at least some monitored activities that are common across multiple pre-infection snapshots.