Summary: LSA Shell is an important Windows component that unfortunately shows up in some virus related error messages. "Export Version" has a murkier history.
Being a proud American why is my copy of XP running LSA Shell (Export Version)? A search of the web pointed me to a lot of articles about the Sasser virus. I use a very good anti-virus and, besides, the Sasser virus is from 2004. What's up with LSA Shell (Export Version)?
•
I'm not totally sure on the "export version" issue, but I have a guess as to where it comes from. Don't take it personally but it is, or at least it was, a matter of national security.
Or at least some people thought so.
•
First, "LSA Shell" is the friendly name for our old pal lsass.exe. As you've seen, we typically hear of it in conjunction with the Sasser worm and other viruses. For various reasons many viruses cause issues that appear to manifest as problems with lsass.exe.
LSA stands for Local Security Authority, which is an important required component of Windows that deals with login authentication and security policies. You'll see it running on a perfectly clean and valid Windows installation. As I said, it's a required component.
Now about that "Export Version". Here's my semi-educated guess.
It used to be that strong encryption was classified as "munitions" by the U.S. government. That put it in the same class as guns, bullets and missiles. The rules were such that munitions could not be exported. In fact, before the restrictions were relaxed, several folks had an encryption algorithm printed onto t-shirts which they would then wear while leaving the country - thus breaking the export law. If it sounds silly it's because it was, particularly considering that many of the better and more commonly used crypto algorithms are coming from overseas anyway.
But regardless of its practicality, the law was the law, and software manufacturers had to deal with it. Typically that meant producing two versions of any software that required cryptography: a version for the U.S. which could use strong crypto, and a version for export which used the weaker cryptography that was allowed to be exported.
Hence the origin of the phrase "export version" - because once upon a time, such a version was necessary.
The question remains why does your machine, presumably bought, paid for, and
delivered in the United States still say "export version"? (For what it's
worth, mine does too 
).
I'm not sure.
It could be as simple as no one having gotten around to cleaning up or changing that label. There could be a compatibility reason. It's possible that there still are two versions, for historical reasons, and that you and I just happen to get this one.
The bottom line as I understand is that there's no practical impact. The restrictions on cryptography were lifted several years ago, and manufacturers have been using strong cryptography across the board ever since.
Related:
-
Ask Leo! - What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?
-
Ask Leo! - Can I delete lsass.exe? svchost.exe?
Article C3118 - August 16, 2007
CAN YOU BLOCK THE LSA SHELL FROM THE INTERNET SERVER? OR WILL IT CAUSE SERIOU8 PROBLEMS WITH THE COMPUTER AND CAUSE IT TO CRASH AND CAUSE YOU TO HAVE INTERNET CONNECTION PROBLEMS LIKE THEY SAY IT WILL? HELP
Posted by: BINGO at December 16, 2007 10:56 PMMy Gateway laptop w/ XP Media Center Edition is about 2 years old and also has the Export Version.
Posted by: Taylor at December 28, 2007 1:15 PMI have a new (Mar 2008) Vostro 1700 laptop with XP-sp2, and it has the "export Version" as well.
Posted by: David at June 24, 2008 4:26 AMshall I allow this to communicate with Windows/system/32/zone labs/avsys/scanning process.exe?
Posted by: MARILYN LOW at June 24, 2008 9:09 AMSo can this LSA Shell (Export Version) be blocked from accessing the Internet, or is it an essential system process? Occasionally it pops up in my Sygate Firewall Pro, and I say No with no problems.
Posted by: Mark at July 3, 2008 8:05 AMHave you ever thought that we probably actually all have an export-authorized version (would it only be because foreigners tend to shop in the US and their computers are not scanned when they leave), and that the full encryption's distribution is only delivered to the military and the like? So that "export" rather means "demilitarized"?
Posted by: Eric Polin at July 9, 2008 7:43 AMAre you for real? Demilitarised encryption? Haven't laughed so much in ages. And people are taking advice on here about securing their PC? Priceless.
Posted by: simon at November 22, 2008 6:27 AMdemilitarized or not, it means it's not based on strong encryption.
Posted by: Stanley Ubanks at March 1, 2009 2:17 AM@Simon
Posted by: Rob at April 23, 2009 3:51 PMIt may seem weird Simon, but they're completely correct. There was once a time when Apple marketed one of their desktop computers on the back of the fact that it could only be exported to nations with most favored status because it could do a gigaflop. Honestly, the Russians really were so far behind at the time that US home computers would have significantly improved their military potential.
Aside from the fact that the new AES adopted by the US Govt and the world at large is called "Rijndael" and originated in Belgium, did it ever occur to anyone that most US namebrand computers with OEM Windows are built, set up and bundled OUTSIDE THE UNITED STATES? The disk images must have been sent out to be installed before the machine is boxed. Is there a "non export version" of a consumer durable in today's globalized world?
Posted by: jmillar at October 30, 2009 12:03 PMToday this is a "non issue" and the absurd "export version" tag should have been quietly dropped.