I run ZA Free Firewall 6.1.744.001, AVG Free 8.5, with XP SP2. Yesterday I noticed that LSA Shell (Export Version) was automatically added to my Program Control in Zone Alarm with GREEN CHECK MARKS for Access Trusted/Internet and ?'s for Server Trusted/Internet. (I just happened to notice since I regularly check the ZA Program Control.) Product name Microsoft® Windows® Operating System File name C:\WINDOWS\system32\lsass.exe Last policy update 7/23/2008 10:56:12 Version 5.1.2600.2180 (xpsp_sp2_rtm.040803-215 Last modified date 2/28/2006 4:00:00 File size 13 KB It just showed up there, but I didn't get any kind of notice -- but that's because it actually didn't try to connect to the internet or anything, as far as I can tell. (I looked through the Program Alert Logs in ZA and there is no entry for it.) This happend a looooooong time ago once before (like a couple years ago), and I remember determining that nothing nefarious was going on. But I just wanted to verify this and to ask why this would randomly just happen like that. It shows lsass.ese as in the system32 folder (which is where it's supposed to be -- if it's not, then it's a virus). And this link says that it shouldn't be running at start-up. I did an "msconfig" check and it's not listed as running at start-up. (However, it does show up listed in "Processes" in Task Manager, so something starts it up somewhere at some point, right?) I went ahead and immediately removed it from the Program Control in ZA. And below is a screen capture of what I've got listed in the Program Control right now. (FYI, I have ?'s instead of Green Check Marks for some things because I like to know when it's accessing instead of letting it do it automatically.) (Side Note: I don't know what Application Layer Gateway Service is, but ZA automatically added it at some point in the past, but it's never asked for access to anything.) Any thoughts? (I will do a AVG scan right now and a search for lsass.exe to make sure it's just in System32 just to be safe...) Thanks!