AppCheck is a ransomware response product, so you should use it together with an antivirus product to protect your system more safely.

The memory integrity activation support version is supported from AppCheck version 3.1.28.3.

The AppCheck installation file provided by the Checkmal site is installed as a 15-day trial version of AppCheck Pro for Windows Server when installed in a Windows server environment.
However, after 15 days, if you do not register the product through license purchase, an expiration window will be created.

This message is because AppCheck is not allowed to be removed by the CMS central management policy, so please ask the CMS central management manager to remove AppCheck.

This message is because AppCheck is not allowed to be removed by lock settings, so please disable it through "Options-General-Disable lock settings (enter password)-Apply" and then delete it.

Please use the security features provided by the manufacturer of the NAS storage device to protect it. AppCheck cannot be installed in the NAS storage device.

Basically, checkmal does not provide a distribution program for automatic installation of AppCheck. However, it can be installed automatically through other solutions such as S1 SESP agent or NAC/PMS provided by the customer.

The Windows 7 operating system can be installed from Windows 7 Service Pack 1 (SP1) or later, and additionally, the SHA-2 signature patch (KB4474419) must be installed.

※ KB4474419 MS SHA-2 patch download: https://www.catalog.update.microsoft.com/search.aspx?q=kb4474419

AppCheck provides Korean, English, and Japanese languages by default, and is automatically installed in the corresponding language depending on the operating system language when installed. However, the language cannot be changed after installation.

Individuals/corporate businesses that wish to issue a tax invoice among customers who have purchased AppCheck Anti-Ransomware should send a copy of their business registration certificate and an email address to receive an electronic tax invoice to contact@checkmal.com.

For AppCheck Pro products, you can purchase 1/3/5 PC licenses with 1 license. If you want to purchase other quantities, please contact sales@checkmal.com
Please apply for AppCheck Pro for Windows Server products through "Purchasing - Quotation and Demo Inquiry" on the CheckMal site.

In the case of individual purchasing users, you can receive re-sent to the e-mail address you entered at the time of purchase in "Customer Support - License Management - Resend License" on the Checkmal site.
For other corporate purchase customers, please contact contact@checkmal.com and we will send you a license email again.

Error code 0xc0000003 when registering AppCheck Anti-Ransomware is caused by exceeding the number of licensed users.


In the case of individual purchase, please enter your email address and license key in the "Customer Support - License Management - License Check" menu on the Checkmal website to cancel registration if there are devices that exceed the number of licenses.
In the case of corporate purchase customers, request a list of registered devices for license initialization to support@checkmal.com, and check and send the deregistered devices in the Excel document received, and we will support initialization.

If the existing AppCheck anti-ransomware license information is renewed as it is, the service expiration date is automatically updated within 24 hours after renewal, so there is no additional modification by the user.

If you request a refund (contact@checkmal.com) by canceling the purchase within 7 days of paying for the AppCheck anti-ransomware product, you can receive a refund within 3 to 5 business days in the same way as payment.
If you have registered the product online using the serial number issued within 7 days of payment, a refund is not possible.

In the case of an AppCheck license registered in CMS Business/Cloud central management, it can be modified in the "CMS Access - Settings - License - License Email" menu. However, the CMS Business server must be able to communicate with the CheckMall license server.

In the case of AppCheck Anti-Ransomware-only installation environment, you can request to change your email address through the "Customer Support - Online Inquiry" bulletin board on the Checkmal website.

If you register the AppCheck Pro version as an individual purchase method and then use it in a company, the license purchased by the individual must be purchased and owned by the company under the current law. Not accepted.

Therefore, if it is intended for use by a company, please receive consultation and quotation for corporate purchase.

Since the license used to register AppCheck is for an OS that is not supported, please enter AppCheck Pro for Windows Server license information when registering in Windows Server operating system.

After installing AppCheck Anti-Ransomware, execute "Customer Center - Product and License Information - License Registration" menu on the main screen and enter the issued email address and serial number.

The main difference between of AppCheck Pro and Free version is below.

1. Automatic Remediation and Block

AppCheck Free only blocks and kills the process while AppCheck Pro blocks and deletes(remediates) the detected Ransomware behaved files.

Automatic recovery of damaged files are both supported.

2. Network Drive and SMB Server Protection

AppCheck Pro provides protection of Network Shared folders. Any file damage or encryption behavior to attached shared folder will be detected and blocked. Especially SMB Server Protection provides protection against unwanted file change of current host's shared folder.

3. Auto Backup

AppCheck Pro provides additional protection through flexible scheduled backup of user specified folder or files.


More details and comparison chart can be found in this page.

Message is logged "Automatic Backup is completed (error: 53)".
If this message occurs, please check your IP address or computer name is correct for "Server" field, and shared folder is correct "Share" field in "Option > Auto Backup"

Below is example for entry of each field.
 

You may recover your original files if infection happened if AppCheck is installed beforehand.

However, neither AppCheck and AppCheck Pro does not support the recovery once files were encrypted before the installation.

Select Update and Security from Settings – Recover, and then run Restart Now from Advanced Start.
When you restart your PC, you can start it in safe mode (using networking) by selecting 4 or F4 (5 or F5 if you need to use the Internet) key in the list of options.

For more information, please refer to the link below.

https://www.lifewire.com/how-to-access-advanced-startup-options-in-windows-10-or-8-2626229

Go to Power – Restart, press and hold the Shift key, and then press Enter. You will see the Select Options screen.
Troubleshooting – Advanced option, select command prompt to get into recovery console. For more information, please refer to the link below.

https://www.lifewire.com/how-to-access-advanced-startup-options-in-windows-10-or-8-2626229

This is a problem caused by a conflict after the update or an unknown problem.
Delete last update and reinstall the operating system to fix the problem.

If you get the message saying that a file is corrupted, the storage device might have a problem (cable failure, logical failure, or bad sector creation, abnormal temperature, etc.).
Proceed a boot recovery from the recovery console through bootcfg / rebuild

There are many reasons for the blue screen.
It could be a hardware malfunction, a crash on device driver, kernel or program or a malicious code infection.
Therefore, it requires to check thoroughly of both software and hardware.

Easiest solution that you can try is to run into safe mode and remove a recently installed program or driver.

This problem is caused by an Autorun malware infection, please run a scan with antivirus program.
All original files would be changed to hidden properties, so please find hidden files in Windows Explorer and remove them.

It could be a problem with the codec program that plays the video and sound.
Delete the codec program and reinstall it to fix the problem.

It is more likely to have issue on hardware.
Mostly graphic card may have a problem.
Check the status of your computer, graphic card and cable.

Certain programs unwillingly modify your browser's Start Page to attract traffic and advertisement.
If the Start Page you have set up is constantly changing automatically, use AppCheck Cleaner to resolve the problem.

AppCheck Cleaner can remove malicious programs and initialize which affect web browser experience.
If web browser (Internet Explorer / Firefox / Chrome) has the unknown programs installed, it can be resolved using AppCheck Cleaner.

There are various reasons when the Internet is slow or unstable.
It can be caused by unwanted programs or recently installed security programs.
If it is infected by the malicious code, AppCheck Cleaner clears and restores it to its normal state.
 
[In case of infected by malicious code]
1. Caused by performing an unknown task due to a malicious code infection
2. Caused by malware which re-routes your connection.
 
AppCheck cannot resolve the following cases:

[Normal cases]
1. Operating System update – Wait until Windows OS update is completed.
2. Other program or application update – Wait until the update of program or application is done.

[Hardware or external issues]
1. Home router issue – Reboot your router or contact router manufacturer.
2. Internet connection issue – Reboot the modem or contact Internet Service Provider

A ransomware infection can slow down your computer for encrypting files or being used to crypto currency mining.
Optimize your PC's performance with the AppCheck Cleaner; removes malware and resets invalid configuration of your PC.

PreparingMalicious codes can be removed by using the AppCheck Cleaner.
Simply clicking the scan button on main screen.

ActiveX is often installed automatically on your PC by malicious websites to access information directly to your PC.
Some banks require for installation, but you can delete them after completing your task.

AppCheck Cleaner removes malicious code disguised as ActiveX but does not remove normally installed ones.

Most of the reason that pop-up ads or ad banners keep appearing is programs that were recently installed may include adware.
Try to find and delete the list of programs you have recently installed in control panel.
AppCheck Cleaner features easy removal of adware.

This is due to invalid credential of target network share.
 
Please check id and password, and try again.

Due to the insufficient space of destination, AppCheck Auto Backup cannot continue the backup.
 
You may change the destination or remove unnecessary files to free up disk space.

When AppCheck Auto Backup cannot reach to target location, AppCheck logs "Auto Backup is completed (Error: 3)".
 
Check destination folder or path is available.

This is error when you have enabled Auto Backup to Network Drive, but unable to reach to destination server because of invalid server address or destination share name.
 
Please check information and try again.

 When you encounter error message (ERROR=21007), it is most likely related to your Internet connection.
 
Please check your Internet connection and try again. If error persists, please contact to Online Support.

This is because AppCheck application doesn’t have permission to destination folder.

To recover files, please follow the instruction below:

1) Right click on AppCheck in tray and select Quit.

2) In Program List, locate AppCheck Anti-Ransomware and right click to bring the context menu.

3) Click "Run program as administrator...".

4) Select files you would like to recover in quarantine and right click.

5) Select "Restore to original position". Your file is restored.

This happens when original destination path is not available.

You may restore your file to another folder using the "Export to specified location" context menu in right click.

If you encounter a blue screen due to a crash related to the AppCheckD.sys driver, boot into Safe Mode (F8) and follow the instruction.

1) ?:\Windows\MEMORY.DMP (Please copy the file to another folder and compress it.)

2) In control panel, uninstall AppCheck.

3) After booting in normal mode, if the following dump file exists, please send the compressed file to Customer Center.

* C:\Windows\MEMORY.DMP (Please copy the file to another folder and compress it.)
* Minidump file is created to ?:\Windows\Minidump folder at blue screen

All files deleted by AppCheck is in Quarantine. You may right click and "Restore to original location" to recover files in Quarantine.

Ransomware Proactive Defense includes automatic recovery of damaged files. You may disable RansomShelter, but some damaged files cannot be recovered.

It is recommended to enable RansomShelter because in case of proactive defense cannot block ransomware behavior, you may able to recover files manually.

AppCheck provides detailed information in "Article 4. Data Collection and Use" in "CheckMAL Software License Agreement" provided in first installation of Anti-Ransomware.

The AppCheck Anti-Ransomware protects installation folders (?:\Program Files\CheckMAL, ?:\ProgramData\CheckMAL) and AppCheck service file(AppCheckS.exe) and will be added additional security if malicious event identifies which interferes AppCheck to function properly.

However, AppCheck Pro provides additional protection for AppCheck service.

This error message is displayed when AppCheck Service process (AppCheckS.exe) is not running properly.

Due to the variety of PC environments, please check following for determine and troubleshooting.

1) AppCheckS.exe file has been deleted and does not exist.
Please check AppCheck installation directory ("?:\Program Files\CheckMAL\AppCheck\AppCheck.exe").
Some of antivirus may detect our application as false positive. Check the diagnosis log or quarantine of your antivirus program and restore the file.

If AppCheckS.exe does not exist, remove "AppCheck Anti-Ransomware" from Control Panel and reinstall it.

2) AppCheckS.exe file exists problem persists.
Try click "Yes" in the error window.
If the same message is repeated, please find the dump file and log file referring to the following information and send the compressed file to Online Request.

Also, if the "AppCheck Anti-Ransomware Service" item is deleted and does not work, please remove "AppCheck Anti-Ransomware" from Control Panel and reinstall it.

[Dump file location] - Check "Show hidden files, folders and drives" in folder options
Locate files %SYSTEMROOT%\System32\config\systemprofile\AppData\Local\CrashDumps\AppCheckS*.dmp. (You may need permissions to access the folder. Please try to access in sequence.)

[Log file location] - Check "Show hidden files, folders and drives" under Folder options
In ?:\ProgramData\CheckMAL\AppCheck, you may locate files with .db and .log extension)

If you cannot find crash dump folder and/or files, please apply following registry to create crash dump, then send it to us after the dump file is created.

[How to set up user dump]
Please download userdump.reg file apply and reboot.

"Ransomware Behavior Detection" protects against data corruption by blocking related processes when tampering multiple file tampering at once.

Sometimes, however, it can also detect suspicious behavior of a normal program.

In this case, you may recover modified files from quarantine as follows.

(1) Check the file path and file name indicated in the item "Detecting Ransomware Behavior" in the "Threat Log" in AppCheck tool.

(2) Add detected normal executive file to whitelist by clicking "User trust file". (※ Please do not add explorer.exe / svchost.exe system file, because it may not prevent file encryption by Ransomware infection.)

(3) Select files for recover in the "Quarantin", and click "Restore to original location" in context menu with the right mouse click.

You might want to report your false positive application to through "Support - Online Support" in our homepage, so we can improve our product for the future.

The option for automatic deletion of files after 7 days is provided.

You may manually delete them by disabling AppCheck real-time protection.

First locate the file encrypted files and remove them.

Then browse to the original file stored in the Ransomware Shelter backup folder<DriveLetter\Backup(AppCheck)>, copy (Ctrl + C) and paste (Ctrl + V) it to desired location.

AppCheck Anti-Ransomware for personal (non-commercial) provides only process block protection from ransomwares.

If you want to remove(remediate) the ransomware itself, please purchase the full version AppCheck Pro.

In case of file tampering behavior is originated from system file, it is only blocked and not deleted and if ransomware binary file is locked and cannot be deleted, file extension is renamed to .bak which prevents from running in the future.