i used autoruns, and i found out that there are two lsass.exe running in the services tab,
the entry name is PolicyAgent, and the other one is ProtectedStorage, i tried to search lsass.exe in the start up list here and didn't found anything that has the name of both lsass.exe, i tried to search info about it in other site and i didn't found any.. is these two lsass.exe is safe? please let me know.. thank you very much..

The policy agent one is most likely malware. Where is the file located?

im so very sorry, i've already deleted it. I also found another one that has the name of " samS " something like that, but after i deleted it, when i check the task manager, there is still a lsass.exe working, maybe it's the original one.