This is my first post to this forum. I use zone alarm pro on 2 different computers (one win2k and the other winxp based). zone alarm prompts you when a program requests internet access. I've also been looking at the xp machine closely (since I had a trojan infection recently and ended up reformating the hd and doing a fresh install of xp). I've been using the demo version of DiamondCS Port Explorer. On the xp machine it shows lsass.exe as connected on a socket but as a "hidden process and not a service or system process." Yet on the win2k machine lsass.exe showes up connected on a socket as a system process. Why would it be any different on the xp machine? ALso, on the xp machine, the messenger service is disabled. Yet zone alarm asks me if messanger can have permission to access the net as a SERVER. Again is that normal and if so, why? Lastly, I've notice that when using the win2k box, zone alarm asks me if i want to allow internet explorer and outlook express to access the internet as a SERVER. Is that normal? If so, why do they need to act like a SERVER on the net (instead of just a normal program)? Thanks for any help.