Frequently Asked Questions

Check out our FAQ for installation and usage, purchases and license registration for AppCheck

Q.
I get message to "install Windows update".
A.
In order to use properly for AppCheck in Windows, you need to install update related to SHA-2 Certificate.

Clicking the message will redirect you to Microsoft website providing the patch. If message has disappeared and to need to check again, then right click on "AppCheck" Tray Icon > "Check Update"

Find out more details in:
https://www.checkmal.com/notice/read/2710/?lang=en&p=1
Q.
What is the difference between AppCheck Free and AppCheck Pro?
A.
The main difference between of AppCheck Pro and Free version is below.

1. Automatic Remediation and Block

AppCheck Free only blocks and kills the process while AppCheck Pro blocks and deletes(remediates) the detected Ransomware behaved files.

Automatic recovery of damaged files are both supported.

2. Network Drive and SMB Server Protection

AppCheck Pro provides protection of Network Shared folders. Any file damage or encryption behavior to attached shared folder will be detected and blocked. Especially SMB Server Protection provides protection against unwanted file change of current host's shared folder.

3. Auto Backup

AppCheck Pro provides additional protection through flexible scheduled backup of user specified folder or files.


More details and comparison chart can be found in
this page.
Q.
Autobackup is completed. (Error: 53)
A.
Message is logged "Automatic Backup is completed (error: 53)".
If this message occurs, please check your IP address or computer name is correct for "Server" field, and shared folder is correct "Share" field in "Option > Auto Backup"

Below is example for entry of each field.
 
Q.
Can I recover files encrypted by Ransomware with AppCheck?
A.
You may recover your original files if infection happened if AppCheck is installed beforehand.

However, neither AppCheck and AppCheck Pro does not support the recovery once files were encrypted before the installation.
Q.
Can I change the email address of my license?
A.
After the license registration, user may want to change the email address.

This process will expire licenses already installed with previous email.

We need your exact name, purchase code (22 digit code ends with with M201X) for the license, and previous email address and new email address you need to transfer.

You may request through "Support - Online Support" in our website.
Q.
Registration Error(1627) occurs.
A.

Registration Error(16267) message occurs when register AppCheck Anti-ransomware in Windows Server Operating System.
 



This error occurs when you register Windows Server using AppCheck Pro license. Please purchase AppCheck Pro for Windows Server license and register.

Q.
I do not have a PayPal account. How can I purchase?
A.

You can purchase AppCheck Pro even though you do not have a PayPal account.

After you enter order information and try to purchase, you will see the page as below.

Click Pay with Debit or Credit Card to purchase without PayPal account.

Q.
Error message while update (ERROR=12175)
A.

You could encounter a message “an error occurred while update. (ERROR=12175)” when you run "AppCheck Information → Check Updates" menu in the environment with AppCheck installed.

 

This error could be caused by preventing to get an update server security certificate because the computer date is set differently from the current time.

Please adjust the computer date and try again.

Q.
I can't enter safe mode in Windows 10.
A.
Select Update and Security from Settings – Recover, and then run Restart Now from Advanced Start.
When you restart your PC, you can start it in safe mode (using networking) by selecting 4 or F4 (5 or F5 if you need to use the Internet) key in the list of options.

For more information, please refer to the link below.

https://www.lifewire.com/how-to-access-advanced-startup-options-in-windows-10-or-8-2626229
Q.
How do I get into the Recovery console?
A.
Go to Power – Restart, press and hold the Shift key, and then press Enter. You will see the Select Options screen.
Troubleshooting – Advanced option, select command prompt to get into recovery console. For more information, please refer to the link below.

https://www.lifewire.com/how-to-access-advanced-startup-options-in-windows-10-or-8-2626229
Q.
After Windows updates, it is slow to boot or to go into document files.
A.
This is a problem caused by a conflict after the update or an unknown problem.
Delete last update and reinstall the operating system to fix the problem.
Q.
A message that says the file is corrupted appears during the boot.
A.
If you get the message saying that a file is corrupted, the storage device might have a problem (cable failure, logical failure, or bad sector creation, abnormal temperature, etc.).
Proceed a boot recovery from the recovery console through bootcfg / rebuild
Q.
When turning on the computer, the blue screen(BSOD) appears.
A.
There are many reasons for the blue screen.
It could be a hardware malfunction, a crash on device driver, kernel or program or a malicious code infection.
Therefore, it requires to check thoroughly of both software and hardware.

Easiest solution that you can try is to run into safe mode and remove a recently installed program or driver.
Q.
All the files were changed to .lnk when turning on the computer.
A.
This problem is caused by an Autorun malware infection, please run a scan with antivirus program.
All original files would be changed to hidden properties, so please find hidden files in Windows Explorer and remove them.
Q.
No video play and no sound
A.
It could be a problem with the codec program that plays the video and sound.
Delete the codec program and reinstall it to fix the problem.
Q.
Computer screen turns black suddenly and shows an unknown message.
A.
It is more likely to have issue on hardware.
Mostly graphic card may have a problem.
Check the status of your computer, graphic card and cable.
Q.
Start Page (Welcome/Initial Page) continues to change automatically.
A.
Certain programs unwillingly modify your browser's Start Page to attract traffic and advertisement.
If the Start Page you have set up is constantly changing automatically, use AppCheck Cleaner to resolve the problem.
Q.
Unknown programs are installed on Internet Explorer / Firefox / Chrome.
A.
AppCheck Cleaner can remove malicious programs and initialize which affect web browser experience.
If web browser (Internet Explorer / Firefox / Chrome) has the unknown programs installed, it can be resolved using AppCheck Cleaner.
Q.
Internet speed is unstable. / It's slowed down.
A.
There are various reasons when the Internet is slow or unstable.
It can be caused by unwanted programs or recently installed security programs.
If it is infected by the malicious code, AppCheck Cleaner clears and restores it to its normal state.
 
[In case of infected by malicious code]
1. Caused by performing an unknown task due to a malicious code infection
2. Caused by malware which re-routes your connection.
 
AppCheck cannot resolve the following cases:

[Normal cases]
1. Operating System update – Wait until Windows OS update is completed.
2. Other program or application update – Wait until the update of program or application is done.

[Hardware or external issues]
1. Home router issue – Reboot your router or contact router manufacturer.
2. Internet connection issue – Reboot the modem or contact Internet Service Provider
Q.
The computer suddenly became slow for no particular reason.
A.
A ransomware infection can slow down your computer for encrypting files or being used to crypto currency mining.
Optimize your PC's performance with the AppCheck Cleaner; removes malware and resets invalid configuration of your PC.
Q.
I can’t remove malware out of my PC.
A.
PreparingMalicious codes can be removed by using the AppCheck Cleaner.
Simply clicking the scan button on main screen.
Q.
Cannot remove ActiveX in Internet Explorer.
A.
ActiveX is often installed automatically on your PC by malicious websites to access information directly to your PC.
Some banks require for installation, but you can delete them after completing your task.

AppCheck Cleaner removes malicious code disguised as ActiveX but does not remove normally installed ones.
Q.
Pop-up ads or ad banners keep appearing.
A.
Most of the reason that pop-up ads or ad banners keep appearing is programs that were recently installed may include adware.
Try to find and delete the list of programs you have recently installed in control panel.
AppCheck Cleaner features easy removal of adware.
Q.
Auto Backup Completed (Error: 86)
A.
This is due to invalid credential of target network share.
 

Please check id and password, and try again.
Q.
Cannot continue backup due to insufficient space.
A.
Due to the insufficient space of destination, AppCheck Auto Backup cannot continue the backup.
 

You may change the destination or remove unnecessary files to free up disk space.
Q.
Auto Backup is Completed (Errror: 1223)
A.
While running Auto Backup, unexpected interruption happens, such as system rebooting or AppCheck update, AppCheck logs "Auto Backup is completed (Error: 1223)".
AppCheck will re-run Auto Backup in next schedule and continue to backup that are not completed.
Q.
Auto Backup Completed (Errror: 3)
A.
When AppCheck Auto Backup cannot reach to target location, AppCheck logs "Auto Backup is completed (Error: 3)".
 

Check destination folder or path is available.
Q.
Auto Backup is completed (Error: 67)
A.
This is error when you have enabled Auto Backup to Network Drive, but unable to reach to destination server because of invalid server address or destination share name.
 

Please check information and try again.
Q.
Error message while update (ERROR = 12007)
A.
 When you encounter error message (ERROR=21007), it is most likely related to your Internet connection.
 

Please check your Internet connection and try again. If error persists, please contact to Online Support.
Q.
I get message "Administrator rights required!" while update or installation.
A.
This message is displayed when User Access Control(UAC) is off and user type is Standard User which doesn't have administrator rights.
 

Users can do following to solve the issue.

(1) Enable UAC will allow automatic update in both administrator and standard user accounts.

(2) In case of UAC needs to disabled, both installation and updates needs to be performed in Administrator account.
Q.
How to register CMS Cloud?
A.
■ Adding License to CMS

After receiving CMS License, registration is required. After the registration, you may able to download Agent Installer, which will be tied to central management console.

(1) CMS Web Console Address : cms.checkmal.com
 
① Click "Register New User" in CMS Login Window.

(2) Check license email received.
 

(3) First Time Login

After the activation of CMS License, sign in with the credential just created. You may see the Dashboard as follows.
 

(4) License Registration for AppCheck Pro v2.0 & AppCheck Pro v2.0 Windows Server

You may receive other license emails, such as AppCheck Pro and AppCheck Pro for Windows Server.
 

(5) Settings → License → Add

You may add multiple licenses for activation. (Agent, Server, etc)
 

※ Note : For example, if you need to add 100 Agent licenses and 10 Server licenses, you may need to add twice, one for a license key for 100 AppCheck Pro, and another for a license key for 10 AppCheck Pro for Windows Server.

(6) License

After activating the license, you may see the list as registration result.
 

After the activation complete, you may now able to download AppCheck Installer by heading to "Distribution" left side menu.
 

(7) Download Client

You can check Authentication Key. This Key is uniquely generated for each company. Click "Download" button will start to download the integrated installer.
 

※Note※ It is recommended not to change the filename. In case of filename change, user manually needs to enter authentication key.
 

Installer is integrated to support both Windows Server and Windows Client PC.

Now you can run installer in each PC.

(8) How to create silent installer

You can modify the filename to enable silent installation mode.

Add "_Silent=Y" to the filename, inside the parenthesis.

ex) Rename "AppCheckSetupCMS[Company=12345689].exe" to 
      "AppCheckSetupCMS[Company=12345689_Silent=Y].exe"
Q.
"?:\Program Files\CheckMAL\AppCheck\mfc140u.dll" error occurs when executing and removing AppCheck.
A.
Some users may experience the error "?:\Program Files\CheckMAL\AppCheck\mfc140u.dll" in the automatic update process.

If you encounter any of the above issues, please uninstall the app check and reinstall it to the latest version using the following procedure.

1) Execute "Command Prompt (Administrator)" and execute "sc stop AppCheck" and "sc stop AppCheckD" in command line in order.
* Note that if you run the in command prompt without administrator privilege, you will be denied access.

2) Run Task Manager and check if AppCheck.exe / AppCheckS.exe process is terminated.

3) Click the [Download Link] of mfc140u.dll file to download and extract the compressed file mfc140u.zip.

4) Select the mfc140u.dll file that is appropriate for your operating system type (32/64 bit) and copy (Ctrl + C) the file to the "?:\Program Files\CheckMAL\AppCheck" folder Ctrl + V) to overwrite the existing file.

* Note that the PC with the folder "Program Files (x86)" is a 64-bit environment.
* x86: 32-bit / x64: refers to the 64-bit operating system.

5) Please visit the homepage (https://www.checkmal.com) and download the latest version of the app check file and reinstall it.

If you cannot solve the problem or if you do not understand the above, please contact Customer Center and we will be able to assist you further through Remote Assistance.
Q.
I’m unable to restore quarantine file. (Code: 5)
A.
This is because AppCheck application doesn’t have permission to destination folder.

To recover files, please follow the instruction below:

1) Right click on AppCheck in tray and select Quit.

2) In Program List, locate AppCheck Anti-Ransomware and right click to bring the context menu.

3) Click "Run program as administrator...".

4) Select files you would like to recover in quarantine and right click.

5) Select "Restore to original position". Your file is restored.
Q.
While AppCheck is updating I get an error “This program is only runs in Windows 7 or higher”
A.
AppCheck reinstalls itself in automatic update, while your configuration is maintained.
 

During the reinstallation process, if uninstaller is corrupted, such message may be displayed.

In this case, you might want to copy files in “?\Program Files\CheckMAL\AppCheck” directory from other PC to according location in your PC, then continue the update.
Q.
How do I activate my AppCheck Pro?
A.
Please click on the registration icon (key shape) on the AppCheck Anti-Ransomware main screen and enter the "AppCheck Pro License Information" (email address, serial number) which issued to your email address.
Q.
Can I have tax refund?
A.

Due to the Customs Act in Korea, we don't apply tax for purchasing software in foreign countries.

Q.
I’m unable to restore quarantine file. (Code: 3)
A.
This happens when original destination path is not available.

You may restore your file to another folder using the "Export to specified location" context menu in right click.
Q.
AppCheckD.sys related blue screen during app check.
A.
If you encounter a blue screen due to a crash related to the AppCheckD.sys driver, boot into Safe Mode (F8) and follow the instruction.

1) ?:\Windows\MEMORY.DMP (Please copy the file to another folder and compress it.)

2) In control panel, uninstall AppCheck.

3) After booting in normal mode, if the following dump file exists, please send the compressed file to Customer Center.

* C:\Windows\MEMORY.DMP (Please copy the file to another folder and compress it.)
* Minidump file is created to ?:\Windows\Minidump folder at blue screen
Q.
I’d like to recover files which were detected as malicious by AppCheck.
A.
All files deleted by AppCheck is in Quarantine. You may right click and "Restore to original location" to recover files in Quarantine.
Q.
Do I need multiple serial numbers when purchasing licenses for multiple PCs use?
A.
No, you can manage them with a single serial number.

To do this, you can specify the number of licenses when you purchase licenses for use on one or more PCs.
Q.
I have lost my license information and can I get it resended?
A.
Yes, If you have lost your AppCheck Pro license information and would like to resend it, please apply for a reissue by entering the e-mail address you entered in the "Resend License Information" form on the "Support → License Management" page.
Q.
I get "Invalid license key or email address" message during the genuine registration process.
A.
If you have reached limit of license for registered PC, you may encounter "Invalid license key or email address" message.

 

To resolve this, please visit select menu "Support > License Management", and enter your email address and serial key. You can review list to revoke license from selected PC.
Q.
If I disable RansomShelter, does it affect Ransomware Proactive Defense?
A.
Ransomware Proactive Defense includes automatic recovery of damaged files. You may disable RansomShelter, but some damaged files cannot be recovered.

It is recommended to enable RansomShelter because in case of proactive defense cannot block ransomware behavior, you may able to recover files manually.
Q.
I’d like to know which information is sent while using AppCheck.
A.
AppCheck provides detailed information in "Article 4. Data Collection and Use" in "CheckMAL Software License Agreement" provided in first installation of Anti-Ransomware.
Q.
Does AppCheck support other languages?
A.
Yes, AppCheck Anti-Ransomware is available in English, Japanese and Korean since version 2.0.1.2.
Q.
Does the AppCheck Pro license applies immediately after purchase?
A.
The license period starts from the day you activate your serial number.
Q.
How do I cancel my purchase or refund my purchase?
A.
AppCheck Pro Anti-Ransomware products can be refunded in the same way as payment within 3 ~ 5 business days by canceling the purchase within 7 days after payment (contact us), Account transfer is a designated account deposit.

If you register online with a serial number issued within a certain period of time, no refund is available.
Q.
After the uninstallation, I still can see RansomShelter backup folder <Backup (AppCheck)> remains.
A.
After uninstalling AppCheck anti-ransomware, please locate and delete the RansomShelter backup folder created for each drive.
Q.
I want to remove the app check product.
A.
AppCheck Anti-Ransomware can be removed normally by executing "AppCheck Anti-Ransomware" item registered in the program list of the control panel.
Q.
Does AppCheck have self protection?
A.
The AppCheck Anti-Ransomware protects installation folders (?:\Program Files\CheckMAL, ?:\ProgramData\CheckMAL) and AppCheck service file(AppCheckS.exe) and will be added additional security if malicious event identifies which interferes AppCheck to function properly.

However, AppCheck Pro provides additional protection for AppCheck service.
Q.
I get error, "Service is not running, do you want to run it now?“ when I run AppCheck.
A.
This error message is displayed when AppCheck Service process (AppCheckS.exe) is not running properly.

Due to the variety of PC environments, please check following for determine and troubleshooting.

1) AppCheckS.exe file has been deleted and does not exist.
Please check AppCheck installation directory ("?:\Program Files\CheckMAL\AppCheck\AppCheck.exe").
Some of antivirus may detect our application as false positive. Check the diagnosis log or quarantine of your antivirus program and restore the file.

If AppCheckS.exe does not exist, remove "AppCheck Anti-Ransomware" from Control Panel and reinstall it.

2) AppCheckS.exe file exists problem persists.
Try click "Yes" in the error window.
If the same message is repeated, please find the dump file and log file referring to the following information and send the compressed file to Online Request.

Also, if the "AppCheck Anti-Ransomware Service" item is deleted and does not work, please remove "AppCheck Anti-Ransomware" from Control Panel and reinstall it.

[Dump file location] - Check "Show hidden files, folders and drives" in folder options
Locate files %SYSTEMROOT%\System32\config\systemprofile\AppData\Local\CrashDumps\AppCheckS*.dmp. (You may need permissions to access the folder. Please try to access in sequence.)

[Log file location] - Check "Show hidden files, folders and drives" under Folder options
In ?:\ProgramData\CheckMAL\AppCheck, you may locate files with .db and .log extension)

If you cannot find crash dump folder and/or files, please apply following registry to create crash dump, then send it to us after the dump file is created.

[How to set up user dump]
Please download userdump.reg file apply and reboot.
Q.
The "Ransomware Behavior Detected" message is displayed and the normal program is forcibly terminated.
A.
"Ransomware Behavior Detection" protects against data corruption by blocking related processes when tampering multiple file tampering at once.

Sometimes, however, it can also detect suspicious behavior of a normal program.

In this case, you may recover modified files from quarantine as follows.

(1) Check the file path and file name indicated in the item "Detecting Ransomware Behavior" in the "Threat Log" in AppCheck tool.

(2) Add detected normal executive file to whitelist by clicking "User trust file". (※ Please do not add explorer.exe / svchost.exe system file, because it may not prevent file encryption by Ransomware infection.)

(3) Select files for recover in the "Quarantin", and click "Restore to original location" in context menu with the right mouse click.

You might want to report your false positive application to through "Support - Online Support" in our homepage, so we can improve our product for the future.
Q.
How do I delete files stored in RansomShelter Backup Folder <Backup (AppCheck)>?
A.
The option for automatic deletion of files after 7 days is provided.

You may manually delete them by disabling AppCheck real-time protection.
Q.
I want to recover the original file stored in RansomShelter Backup Folder <Backup (AppCheck)> due to Ransomware infection.
A.
First locate the file encrypted files and remove them.

Then browse to the original file stored in the Ransomware Shelter backup folder<DriveLetter\Backup(AppCheck)>, copy (Ctrl + C) and paste (Ctrl + V) it to desired location.
Q.
Is the file automatically blocked(cured) by Ransomware behavior detection?
A.
AppCheck Anti-Ransomware for personal (non-commercial) provides only process block protection from ransomwares.

If you want to remove(remediate) the ransomware itself, please purchase the full version AppCheck Pro.

In case of file tampering behavior is originated from system file, it is only blocked and not deleted and if ransomware binary file is locked and cannot be deleted, file extension is renamed to .bak which prevents from running in the future.
Q.
Can I use the AppCheck on Windows XP, Windows Vista operating system?
A.
No, AppCheck Anti-Ransomware is compatible with Windows 7 operating system and above (including service pack version).

Please consider to upgrade your operating system for your protection.
Q.
Can I use AppCheck Anti-Ransomware with other Antivirus?
A.
Yes, AppCheck Anti-Ransomware ensures compatibility with third-party anti-virus programs with real-time protection.

위로