Firewall on CIS

Something or someone is bypassing the firewall. It uses cmdagent.exe and svchost.exe without me browsing the internet and it is loading rootkit or *.dll file. with me just only being connected to the internet.
He is getting general credentials on the Windows 7 home premium 64bit,( that does not happen if you have a user account and not admin). How is that possible?

Can you please explain what you are seeing that makes you believe that this is happening? This will help us to better understand the situation so that we can help.

Nevermind they explained to me that the rootkit might be installed in the ROM. I am sorry