|Lsas.exe and Winlogon.exe are both vital system processes. Termination of either will result in a system reboot.|
In some cases a malware process will have the same name as a normal process. There is no easy way to tell them apart. It is completely normal to have multiple instances of svchost.exe and some other processes.
The SYSTEM process using 90MB memory is not at all unusual on XP. Mine is 95MB as I write this. This will vary depending how much RAM you have, what processes are running, etc.