Recently had guests at the house who used the computer. I just did the first reboot since they left and the MS installer was immediately trying to access http:199.7.71.190 (crl.verisign.net) to install some sort of driver manager. The site comes up in a browser with what looks like an FTP directory that seems odd. I can't think of a reason why verisign would need to install something like that on my side.
The only other thing I can think of that is new is that DW started an account on a site.