When you buy and use a domain name that has seen 'malicious activity' in the past, this can have a negative effect on SEO. How long will this effect last?

If the malicious activity built backlinks, the negative effects can last as long as the backlinks exist...which can be a very long time. If backlinks are not involved, it shouldn't be too hard to get a fresh start.

This is a relevant & recent article on the topic: http://www.seroundtable.com/google-old-penalties-expired-domain-17883.html The final bit reads: "But how much time would it take for the expired domain to have the algorithmic actions expire also? I guess it depends on the links pointing to the site still".