I already had Autoruns (see below more info about it). I don't saw anything suspicious listed here...
Thanks for Process monitor. I see here that 'explorer.exe' is a busy guy... Added a filter to display only explorer and has about 17.000 entires - OMG! Is this normal?
Unfortunately, yes. Don't forget explorer.exe is also the Windows shell.
Before I rebooted my system, I had it turned on for about 8 hours with Wireshark running. At startup svchost did his number in checking those crl files and after a while made a windows update check too. Then nothing.. for about 30-40 minutes nothing suspicious. I ran some random programs, no weird connections. Then I made a list of all the apps I downloaded and all the apps that were preinstalled. Tried some random preinstalled apps and nothing strange. Tried some downloaded apps and only two were bothering explorer.exe.. The two are Process Explorer and Autoruns. Whenever I started one of these two apps, the firewall was alerting me about explorer.exe making a connection. Looking at wireshark.. all it did was to check those crl stuff. So I assume there is nothing wrong with this, right?
Sounds fine to me, although I can't seem to get autoruns or PE to invoke explorer. If your connections were doing something else, I'd be more concerned, as it is, I don't believe there's cause for concern.
Now.. after I rebooted my system to check those UDP connections on port 53, I tried again Autoruns and this time it didn't bother explorer. Tried PE also, and some connections appeared.. I think it was checking something with VeriSign. That was all. Maybe Win7 on x64 need more checking to do... This is my first x64 OS, I don't see big differences but I'm no expert.
As far as I'm aware all Sysinternals applications are signed by Microsoft, not Verisign, so what ever check your seeing isn't for AR or PE.