If you see the following error message “LSA shell has encountered an error” when you connect to the Internet and get 60 seconds countdown after which your PC performs shutdown or have malicious LSASS.exe “LSA shell export version” running in your processes, this article can be of interest for you as here you'll find complete description and solution of this problem.
LSA (Local Security Authority) Shell is a legal and essential component of Windows which is used to control and validate logon for local and remote users in Windows NT, 2000, XP and.Vista. Logon is almost impossible if LSA Shell service is stopped or malfunctions. However, there are several known spyware and trojans that pretend to be legal lsass.exe. They usually have the same name or one of the following names: lsass.exe, lsass2.exe, lassa.exe, isass.exe and several others. Please note that legal lsass.exe should reside in WindowsSystem32 folder and should not appear in startup list.
In most cases this means that you have Sasser, W32.Blaster or Blaster32 virus on your PC. This virus causes LSA Shell and RPC (Remote Procedure Call) failure when you access the Internet. By default Windows shuts down PC in case of such failure. Shutdown is performed not immediately but in 60 seconds after failure for you to save your work. However, it is not enough to solve the problem. This standard behaviour of Windows can be changed. You can tell windows not to restart the whole PC but only service in case of RPC failure. This will give you enough time to solve the problem.
You can remove isass.exe or lsass.exe and fix “LSA Shell export version” and solve similar problems manually.
To completely solve “LSA shell has encountered an error” problem you should:
1) Open “services.msc”
2) Find all entries responsible for “Remote Procedure Call”
3) Change their recovery properties from “Shutdown Computer” to “Restart the Service” for all Failure counts ie. 1st, 2nd and subsequent.
4) Run anti virus scan to remove remains of Sasser or Blaster32 virus from your system
You can also temporarily stop reboot in case you see 60 seconds countdown warning by following these steps:
1) Select Start -> Run
2) Type “shutdown -a” and press Enter
If you are not sure which files and registry keys to delete you can make use of a special program True Sword and remove lsass.exe, lsass2.exe, lassa.exe and isass.exe virus infection. True Sword will find and eliminate this problem and more than 180 000 other dangerous threats including trojans, spyware, adware, riskware, problemware, keyloggers, dialers and other kinds of malicious programs in several seconds.
