1 2 Previous Next 17 Replies Latest reply on Oct 21, 2009 11:38 AM by rmetzger

    VirusScan v8.7 and Outlook - "scanemal.dll" Error

    runcmd

       

      Microsoft Office Outlook[/b]
      Outlook experienced a serious error the last time the add-in 'c:\program files\network associates\virusscan\scanemal.dll' was opened. Would you like to disable this add-in?
      To reactivate this add-in, click About Microsoft Outlook on the Help menu, and then click Disabled Items
      (Yes) (No)



      Upon deploying VirusScan v8.7 overtop of VirusScan v8.0 on a test group of workstations from a new ePO 4.5 server, some users reported the above error message. I found an associated McAfee Knowledgebase Article (KB57977 / "Scanemal.dll or Scanotlk.dll error when opening Outlook") that indicates, "McAfee utilizes the Microsoft approved manner of switching out the scanemal.dll. However this method only works for one user. This issue will only be seen on shared computers with multiple user profiles. When a change is made to the location of the email scanning component of VirusScan, this information may not be reflected in the EXTEND.DAT file used by Outlook." The article then provides a helpful outline of how to correct this issue by deleting the "EXTEND.DAT" file or disabling "Exchange Scan" inside of Outlook.

      Searching this forum for "scanemal.dll" using Google yields 722 results. :eek: I looked at a handful of them but encountered a lot of dead links.

      The users that reported this issue indicated that they selected the "Yes" button to disable the add-in and that the error has not returned. Does anyone know if this means that they have disabled email scanning in the process? My thought was to disable VirusScan on my computer, temporarily, and then email one of the users an EICAR to confirm that their inbound emails are still being scanned but thought I'd ask if anyone else has relevant information associated with this issue.

      Thanks!
        • 1. Yes, eMail scanning is disabled without the add-in.
          rmetzger

          Yes, without the add-in, email is not scanned during which scripts can run (not good).

          Yes, I would test with an attached EICAR file. But whatever you do, MAKE IT CRYSTAL CLEAR that this is ONLY A TEST. Otherwise you may get bombarded with phone calls by panicked people who don't understand the purpose of this test.

          Here is a still live link: http://community.mcafee.com/showpost.php?p=556339&postcount=2

          The simple answer is to delete Extend.dat files from the 'documents and settings' folders.

          Extend.dat is a 'performance' enhancement used by Outlook to load add-ons without the need of looking into the registry for loading instructions. When Outlook is open and you installed the McAfee Outlook Addon, Scanotlk.dll could not be cleared from Extend.dat. Now, every time Outlook loads it is using the cached information in Extend.dat to load a now missing Scanotlk.dll file -- thus the error message.

          The good news is that the Extend.dat file is completely rebuilt if it is deleted. When Outlook is run the next time, it rebuilds Extend.dat using the current settings in the registry to repopulate the correct information.

          This needs to be done while Outlook is closed. I would suggest doing this from a login script, which should happen before Outlook is running.

          del "%Userprofile%\Local Settings\Application Data\Microsoft\Outlook\Extend.dat"

          As an administrator I use this:
          del /f /s /q "%SystemDrive%\Documents and Settings\Extend.Dat"
          You may need to alter this for Vista systems.

          You may wish to re-enable the McAfee Add-in once Extend.Dat has been removed.

          Hope this helps.
          Ron Metzger
          • 2. RE: Yes, eMail scanning is disabled without the add-in.
            Hi,

            I found the poblem on a few workstations when upgrading from 8.0 to 8.7.

            I found that it is easily fixed by unticking the add ins in outlook manually (from add ins)
            Tools, options, other, advanced options.

            Then re-start outlook and re-tick it.

            Sometimes when I went ther I would see a duplicate, sometimes not.
            For those ones, once I unticked everything, re-started outlook, then the duplicates disappeared


            That actually fixed it in all my cases, so I would give that a try, simple but it worked.
            • 3. RE: Yes, eMail scanning is disabled without the add-in.
              rmetzger

              Yes, that is what is suppose to happen, but often doesn't work correctly. 'Unticking' the add-in is meant to clear the Registry Entry for that add-in; followed by a restart of Outlook, which is 'suppose' to clear the entry in Extend.dat. This is where the troubles start.

              First: This happens only on a per user basis, which means that each person is going to have to log in and go through this Add-in removal process.

              Second: Clearing Extend.Dat entries does not always happen (reliably).

              Third: Changing the version of VSE from 8.0 to 8.7 changes the Add-in; 'Unticking' the new add-in does not mean the old is removed from the registry or from Extend.dat.

              It is working for you and that's great.

              I actually found this problem when first installing VSE v8.5i, replacing Symantec's program. I found the solution listed in Symantec's web site. It appears this problem is not isolated to McAfee or Symantec, rather it is an architectural 'side effect' of Outlook. Turned out that since Symantec's add-in was no longer 'installed' so there was nothing to 'untick.'

              Whenever the registry entries get out of sync with those in Extend.Dat, Outlook posts these messages whenever that add-in is loaded. (It looks to Extend.Dat before the registry, supposedly for performance reasons.) Since the registry is, in this case, usually correct, Extend.Dat becomes the problem whereby it does not match the registry entries for the existing Add-ins. Deleting Extend.Dat (for every user) causes Outlook to rebuild at startup (and resynchronize) the add-ins listed within the registry to those in Extend.dat.

              So, the only reliable solution is to remove Extend.Dat from all User Profiles and allow Outlook to rebuild it the next time Outlook is run. In my humble opinion, I have yet to see a downside to deleting Extend.Dat.

              From a login script:
              del "%Userprofile%\Local Settings\Application Data\Microsoft\Outlook\Extend.dat"

              As an administrator I use this:
              del /f /s /q "%SystemDrive%\Documents and Settings\Extend.Dat"
              For Vista and Win7 systems:
              del /f /s /q "%SystemDrive%\Users\Extend.Dat"


              Thanks,
              Ron Metzger
              • 4. RE: Yes, eMail scanning is disabled without the add-in.
                PhilR
                I concur with Ron here.

                I've been deleting extend.dat on login for several months now without problems.

                Phil
                • 5. RE: Yes, eMail scanning is disabled without the add-in.
                  runcmd
                  I've since had one user report this as an on-going issue and renaming the "EXTEND.DAT" resolved the issue for her. An EICAR was immediately detected and quarantined when I sent it to her. I did send an EICAR to one of the other people who reported this problem as a one-time event and am yet to hear back from him. My test group was approximately 100 computers and only three users have reported this problem so far. I think I'll wait to see how widespread this problem becomes before I consider using a logon script to kill the "EXTEND.DAT". Thanks for all the responses! Most helpful!
                  • 6. RE: Yes, eMail scanning is disabled without the add-in.
                    runcmd
                    FYI Only: I've also seen this error as...

                     

                    Microsoft Office Outlook[/B]
                    The add-in "C:\Program Files\Network Associates\VirusScan\scanemal.dll" could not be installed or loaded. This problem may be resolved by using Detect and Repair on the Help menu.
                    (OK)



                    Same fix as previously mentioned.
                    • 7. RE: Yes, eMail scanning is disabled without the add-in.
                      rmetzger

                      You can try to Detect and Repair until you are blue in the face; it won't help.

                      Simply delete Extend.dat and let Outlook rebuild Extend.dat the next time Outlook runs.

                      Have fun.
                      Ron Metzger
                      • 8. RE: Yes, eMail scanning is disabled without the add-in.


                        Yea, Sounds like a better option that what I was doing by unticking the box manually.

                        In my environment the error doesn't happen very often, roughly about 0.5% of clients so far have showed the error when upgrading from to 8.7, so very few and far between.

                        Just out of interest, does this error still occur with office 2007?
                        • 9. RE: Yes, eMail scanning is disabled without the add-in.
                          runcmd


                          So far, all the users that have reported this issue in my environment were running Outlook 2003. We do have a mix of 2003 and 2007 so if I have any 2007 users encounter this error I'll be sure to let you know. In my test group deployments, I'm averaging about 2% of users encountering it.
                          1 2 Previous Next