|Boot to safe mode.|
Use command line to access each users Directory and Settings folder. Use command attrib. If it returns lsass.exe then rename it. You have a virus. If not then get copy of known good lsass.exe and replace it it sys32 folder.
"Best Practices", Event viewer, host file, perfmon, antivirus, anti-spyware, Live CD's, backups, are in my top 10