Hi, I have a few questions concerning the same program/problem:

1. During the last few hours, ZoneAlarm has been asking twice whether LSA Shell (Export Version) (it is indeed lsass.exe, not a similar name, and the date it has last been changed at doesn't look suspicious either) should be allowed to accept connections from the internet (the same IP adress was shown in both cases). I can't remember this occuring ever before; Norton AntiVirus, Ad-Aware and Spybot Search & Destroy don't find anything on my PC and I haven't noticed any other suspicious stuff (XP SP2 is up to date, I use Mozilla's products for browsing and mailing and I'm quite careful in general). What could that message be related to? Might it be anything to worry about?

2. When I took a look at my Program Control list, I noticed that LSA Shell (Export Version) was allowed to access the trusted and internet zones. I don't remember allowing it to do so -- is it one of the programs that are allowed to access the internet automatically after ZoneAlarm's installation? (I have removed it from the list in the meantime.)

3. Probably the least important one: While doing research about that problem, I let Windows Explorer look for files containing the word lsass in my Internet Logs folder and opened safeprograms.xml afterwards (it opened in Internet Explorer) -- is it dangerous to open said file, i.e. might any settings be changed etc. simply through opening it?

Thanks for any replies!

Operating System:Windows XP Home Edition
Product Name:ZoneAlarm (Free)
Software Version:5.5