It can be uncomfortable when you ask and the user immediately begins to dodge and rationalize. I usually cut them off and tell them I have enough info to get started. I always try to find a way to get them off the hook.

You also have to careful giving advice. If they denied going to a porn site, but it's obvious that's what the problem is, you can't say "you know, visiting porn on the web is a surefire way to get your computer compromised..." Rather a more generic answer will work as well. "There are web sites out there that you merely have to land on them and they've already pushed malware onto your system..." They'll get the drift.