Based on the general state of the computer, and many times customers asked me to try to identify the source of the infection.
To do this I checked the history for recently visited sites.
Before most browsers had private browse modes, and the ability to only delete recently browsed data, a non empty history with no obvious porn listings could usually be taken at face value.
In my experience a lot of users, those that know more than nothing but aren't quite adept enough to not get malware, know how to selectively delete their history.
That's no to say that dodgy porn sites are the only vectors. In fact I find the most common vector for viruses these days is stupidity. The nastiest viruses to remove are the ones that can't install themselves, spread themselves, make no attempt to hide from antivirus, but have a whopping huge payload ready for whoever will run omg_awesome_kitten_pic.jpg.exe (which they've downloaded from Limewire, or Bittorrent, or has been IM'd to them over MSN).
To do this I checked the history for recently visited sites. Before most browsers had private browse modes, and the ability to only delete recently browsed data, a non empty history with no obvious porn listings could usually be taken at face value.