What is "LSA Shell" and why is it an "Export Version"?

Home » Windows » Windows Components

Summary: LSA Shell is an important Windows component that unfortunately shows up in some virus related error messages. "Export Version" has a murkier history.

I'm not totally sure on the "export version" issue, but I have a guess as to where it comes from. Don't take it personally but it is, or at least it was, a matter of national security.

Or at least some people thought so.

•

First, "LSA Shell" is the friendly name for our old pal lsass.exe. As you've seen, we typically hear of it in conjunction with the Sasser worm and other viruses. For various reasons many viruses cause issues that appear to manifest as problems with lsass.exe.

LSA stands for Local Security Authority, which is an important required component of Windows that deals with login authentication and security policies. You'll see it running on a perfectly clean and valid Windows installation. As I said, it's a required component.

Now about that "Export Version". Here's my semi-educated guess.

It used to be that strong encryption was classified as "munitions" by the U.S. government. That put it in the same class as guns, bullets and missiles. The rules were such that munitions could not be exported. In fact, before the restrictions were relaxed, several folks had an encryption algorithm printed onto t-shirts which they would then wear while leaving the country - thus breaking the export law. If it sounds silly it's because it was, particularly considering that many of the better and more commonly used crypto algorithms are coming from overseas anyway.

But regardless of its practicality, the law was the law, and software manufacturers had to deal with it. Typically that meant producing two versions of any software that required cryptography: a version for the U.S. which could use strong crypto, and a version for export which used the weaker cryptography that was allowed to be exported.

Hence the origin of the phrase "export version" - because once upon a time, such a version was necessary.

The question remains why does your machine, presumably bought, paid for, and delivered in the United States still say "export version"? (For what it's worth, mine does too ).

I'm not sure.

It could be as simple as no one having gotten around to cleaning up or changing that label. There could be a compatibility reason. It's possible that there still are two versions, for historical reasons, and that you and I just happen to get this one.

The bottom line as I understand is that there's no practical impact. The restrictions on cryptography were lifted several years ago, and manufacturers have been using strong cryptography across the board ever since.

Related:

• Ask Leo! - What are "LSASS", "LSASS.EXE" and "Sasser" and how do I know if I'm infected? What do I do if I am?

• Ask Leo! - Can I delete lsass.exe? svchost.exe?