Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: LSA Shell (Export Version) question

  1. #1
    superyeti Guest

    Default LSA Shell (Export Version) question

    I'm running ZoneAlarm Internet Security Suite 6.1.737 and keep getting the following ZA Security Alert:

    "LSA Shell (Export Version) is trying to communicate with C:\Windows\System32\ZoneLabs\vsmon.exe -service by opening its process"

    What is LSASS.EXE trying to do with vsmon.exe? Should I allow this?

    Operating System:Windows XP Home Edition
    Product Name:ZoneAlarm Internet Security Suite
    Software Version:6.0

  2. #2
    flyyourway Guest

    Default Re: LSA Shell (Export Version) question

    LSA is the "Local Security Authority" for Windows it supports account rights and privliges,and user profiles. This process may query the Vsmon.exe for specific reasons,and all ZA is doing is warning you of this NORMAL behavior.I would allow the action.

  3. #3
    brasidas Guest

    Default Re: LSA Shell (Export Version) question

    I'm getting the same message on startup, every time, no matter how often I allow it. I also get it when ZA tries to access IE. This is annoying -- any clue on how to make it stop, or is this just a bug in the most recent version of ZA?

  4. #4
    flyyourway Guest

    Default Re: LSA Shell (Export Version) question

    Have you scanned for Virus'?If you have and all is clear it might be that Zone Alarm has a corrupted database and needs to be reset,this can be accomplished by disabling ZA and then deleting all the contents of the Internet Logs folder on the drive windows is installed.If you get a access error message you may have to perform the task inSafe mode .Just be aware that deleting all the contents of that folder will make you have to reconfigure the entire firewall from scratch,but it should resolve the issue you are experiencing.

  5. #5
    brasidas Guest

    Default Re: LSA Shell (Export Version) question

    Thanks, will try. I've run Norton, Panda, and TrojanHunter, and all come up clean.

  6. #6
    brasidas Guest

    Default Re: LSA Shell (Export Version) question

    OK, very strange. I emptied out the Internet Logs folder, and had to go to Safe Mode to get rid of one file, but did it. First startup, no problem, second, the warning appeared.
    So I decided to reinstall ZA, and both times the installer crashed at "Configuring ZoneAlarm." However, ZA now works without the error message. I can only guess that the installer got far enough along that it copied over whatever corrupted file was in there. As I said...all virus scans are clean, so I'm guessing this is either a bug or something got corrupted.

  7. #7
    superyeti Guest

    Default Re: LSA Shell (Export Version) question

    I Googled "LSASS.EXE" and found out that the file can sometimes be used to hide the following worms:

    Windang.worm
    irc.ratsou.b
    Webus.B
    MyDoom.L
    Randex.AR
    Nimos.worm

  8. #8
    brasidas Guest

    Default Re: LSA Shell (Export Version) question

    Yeah, it can hide worms and stuff, but two things to consider:1. All my virus and trojan scans (Norton, Panda, TrojanHunter) are turning up nothing.2. A *lot* of people are having the same issue here with this particular warning, and *only* since they updated to the current version.I suspect this is some sort of bug in ZA.

  9. #9
    brasidas Guest

    Default Re: LSA Shell *The Mystery is solved!*

    Oops. Darn Enter key. This is what I got from ZA tech support:
    Iunderstand that you would like to stop the LSA Export Shell alerts.
    These are most likely part of the OS firewall feature, new in version 6.0.
    If you would like to allow these alerts, please go ahead.
    If you would like to stop these alerts, please do the following.
    Double-click the ZA icon down by the clock.
    Click program control -> main, and then click the custom button for program control.
    Un-check OS firewall, click ok, and this should resolve this issue.And in fact, that resolved the issue. Mystery solved.

  10. #10
    flyyourway Guest

    Default Re: LSA Shell *The Mystery is solved!*

    So you actually have to disable the OS Firewall to make these alerts stop appearing?Then why upgrade to the newest version?Your disabling a feature which is supposed to protect your system from spy ware and other INTERNET diseases,so I wouldn't recommend you disabling it,seems like a bug in the OS Firewall part to me.

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •