Helping people with computers... one answer at a time.

LSA Shell is an important Windows component that unfortunately shows up in some virus related error messages. "Export Version" has a murkier history.

Being a proud American why is my copy of XP running LSA Shell (Export Version)? A search of the web pointed me to a lot of articles about the Sasser virus. I use a very good anti-virus and, besides, the Sasser virus is from 2004. What's up with LSA Shell (Export Version)?

I'm not totally sure on the "export version" issue, but I have a guess as to where it comes from. Don't take it personally but it is, or at least it was, a matter of national security.

Or at least some people thought so.

First, "LSA Shell" is the friendly name for our old pal lsass.exe. As you've seen, we typically hear of it in conjunction with the Sasser worm and other viruses. For various reasons many viruses cause issues that appear to manifest as problems with lsass.exe.

LSA stands for Local Security Authority, which is an important required component of Windows that deals with login authentication and security policies. You'll see it running on a perfectly clean and valid Windows installation. As I said, it's a required component.

"It used to be that strong encryption was classified as "munitions" by the U.S. government."

Now about that "Export Version". Here's my semi-educated guess.

It used to be that strong encryption was classified as "munitions" by the U.S. government. That put it in the same class as guns, bullets and missiles. The rules were such that munitions could not be exported. In fact, before the restrictions were relaxed, several folks had an encryption algorithm printed onto t-shirts which they would then wear while leaving the country - thus breaking the export law. If it sounds silly it's because it was, particularly considering that many of the better and more commonly used crypto algorithms are coming from overseas anyway.

But regardless of its practicality, the law was the law, and software manufacturers had to deal with it. Typically that meant producing two versions of any software that required cryptography: a version for the U.S. which could use strong crypto, and a version for export which used the weaker cryptography that was allowed to be exported.

Hence the origin of the phrase "export version" - because once upon a time, such a version was necessary.

The question remains why does your machine, presumably bought, paid for, and delivered in the United States still say "export version"? (For what it's worth, mine does too Smile).

I'm not sure.

It could be as simple as no one having gotten around to cleaning up or changing that label. There could be a compatibility reason. It's possible that there still are two versions, for historical reasons, and that you and I just happen to get this one.

The bottom line as I understand is that there's no practical impact. The restrictions on cryptography were lifted several years ago, and manufacturers have been using strong cryptography across the board ever since.

Article C3118 - August 16, 2007 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

Charles baker
August 22, 2007 3:22 PM

For what it's worth, I own a Presario with preloaded Win XP Home and my LSA Shell is an "export version" also.

August 29, 2007 12:09 PM

My hp pavilion with xp media center edition is about a year old and it also has the export version.

December 16, 2007 10:56 PM


December 28, 2007 1:15 PM

My Gateway laptop w/ XP Media Center Edition is about 2 years old and also has the Export Version.

June 24, 2008 4:26 AM

I have a new (Mar 2008) Vostro 1700 laptop with XP-sp2, and it has the "export Version" as well.

June 24, 2008 9:09 AM

shall I allow this to communicate with Windows/system/32/zone labs/avsys/scanning process.exe?

July 3, 2008 8:05 AM

So can this LSA Shell (Export Version) be blocked from accessing the Internet, or is it an essential system process? Occasionally it pops up in my Sygate Firewall Pro, and I say No with no problems.

Eric Polin
July 9, 2008 7:43 AM

Have you ever thought that we probably actually all have an export-authorized version (would it only be because foreigners tend to shop in the US and their computers are not scanned when they leave), and that the full encryption's distribution is only delivered to the military and the like? So that "export" rather means "demilitarized"?

November 22, 2008 6:27 AM

Are you for real? Demilitarised encryption? Haven't laughed so much in ages. And people are taking advice on here about securing their PC? Priceless.

Stanley Ubanks
March 1, 2009 2:17 AM

demilitarized or not, it means it's not based on strong encryption.

April 23, 2009 3:51 PM

It may seem weird Simon, but they're completely correct. There was once a time when Apple marketed one of their desktop computers on the back of the fact that it could only be exported to nations with most favored status because it could do a gigaflop. Honestly, the Russians really were so far behind at the time that US home computers would have significantly improved their military potential.

October 30, 2009 12:03 PM

Aside from the fact that the new AES adopted by the US Govt and the world at large is called "Rijndael" and originated in Belgium, did it ever occur to anyone that most US namebrand computers with OEM Windows are built, set up and bundled OUTSIDE THE UNITED STATES? The disk images must have been sent out to be installed before the machine is boxed. Is there a "non export version" of a consumer durable in today's globalized world?
Today this is a "non issue" and the absurd "export version" tag should have been quietly dropped.

February 3, 2010 9:50 AM

i blocked it with ESS

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to to ask your question.