How To Remove “The ArialText Font Was Not Found” Virus

Phrases “The ArialText font was not found” and “Microsoft Font Pack is not installed” belong to a deceptive malware advertising campaign which can lead to serious damage to your computer.

If you constantly see this popup appearing you are most likely infected with other malware. ArialText popups try to trick users into downloading suspicious files and installing them on their computers. Once installed they infect your system with various dangerous viruses including Cerber ransomware which encrypts your files and makes them unopenable.

You should never download the suggested files even though they might look like legitimate Windows components. Also, constant “font is not installed” popups mean that your computer is most likely already infected with other malware which you should remove as soon as possible.

We have an automatic removal tool provided below. It will not only clean up your system from this and any other infections but also protect it in the future.


Recommended Method: Download Malware Removal Tool

Version:   All Updated:   2 days ago Compatible OS:   All
This is the most suitable program for automatically removing the threat and repairing your PC.
Works with: Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP. Read instructions here
File name Size
mb3-setup.exe 56.5 MB

Click here to download alternative tool

What is The ArialText font was not found virus?]

This popup is usually shown when you visit certain infected sites or simply launch your browser. It is designed to deceive users into thinking that a Windows font is needed in order to correctly display website content. The background is filled with unreadable symbols which looks convincing but is actually just a trick used by the malware distributors.

If you click the download (“Update”) button you will be prompted to download ArialFondLight.zip, usually from a malicious domain sobberinfo.com. The archive can contain various infected files. Usually 36d4.exe and mMSBuild.exe files are used to infect potential victims. If you launch these programs they will immediately execute Cerber ransomware and encrypt all your files making them unopenable. Therefore, you should avoid launching suspicious programs at any costs in order to prevent irreparable damage.

There are several popup versions. The simplest one only says “Microsoft Font Pack not installed” while other ones are more complicated and designed to look like legitimate Windows messages:

The web page you are trying to load is displayed incorrectly, as it uses the “ArialText” font.
To fix the error and display the text, you have to upload the “Microsoft Font Pack”.
Manufacturer: Microsoft Corporation.
Current version: Microsoft Font Pack 11.0.3001.24
Latest version: Microsoft Font Pack 52.0.2924.44

Another version:

The “ArialText” font was not found.
To install “ArialText” font for your PC:
1. Download the installer file.
2. If prompted, click Run and Save
3. If you chose Save, double-click the installer file to start the installation process. 
We will automatically import your home page settings and browser history for you.
4. Reboot Microsoft:
Windows 7: A Microsoft window opens once everything is set up.
Windows 8 and 8.1: A welcome dialogue appears, click Next to select your default browser.
Windows 10: A Microsoft windows opens once everything is set up. 
You can then make Microsoft your default browser.

You should never click on such popups in order to avoid getting infected by serious malware. However, simply ignoring them is usually not enough as such popups are usually being shown by other malware which is already on your computer. Therefore, you need to clean up your system in order to make sure that your PC does not have any adware or more dangerous threats.

We recommend using the automatic removal tool which is provided at the beginning of this article. The tool will not only remove this and any other threats but will also secure your system in the future. We have also prepared manual removal instructions for experienced Windows users. However, this guide does not guarantee protection and is not as reliable as the automatic option.

Screenshots of the virus:

 


 Manual Removal Instructions:

NB: Make sure you follow the manual removal guide carefully. Even if you remove the virus there are chances that it will come back later if your computer is not protected. This is why we recommend using the automatic removal and protection tool listed at the beginning of this page.

Step 1:

Remove any suspicious programs that might contain the adware.

Start by opening the Programs and Features window using the following method:

Hold Windows () key and click R key while holding.

Enter the following in the field:

appwiz.cpl

Click OK.

You might have to wait a bit before the list of all programs is loaded as it displays a list of all programs installed on your PC.

We recommend sorting the programs by “Installed On” column (simply click on the column name in order to sort by this value).

Look for any recently installed suspicious programs that might contain the adware as a bundle or could be the adware itself. If you have never seen or used an app chances are that it is an unwanted software.

 

Uninstall all suspicious programs by right-clicking on them and choosing Uninstall…

Repeat this process until no more suspicious programs are left.

Step 2:

Check your hosts file for any suspicious IPs that could be inserted by the virus.

Press and hold Windows () key and click R key.

Enter the following in the field:

notepad %windir%/system32/Drivers/etc/hosts

Click OK.

If you see any suspicious IP addresses in the opened file that are not marked by a “#” in front of them, simply delete the entries and save the file.

Then, at the bottom of the file, paste the following text and save it:

127.0.0.1 sobberinfo.com

Step 3:

Clean up Windows temporary files.

You can safely remove all temporary files without posing any risk to your computer.

Hold Windows () key and click R key.

Enter the following in the field:

%Temp%

Click OK.

All temporary files will be listed in the directory.

Select all temporary files by simultaneously pressing CTRL + A and delete them.

Step 4:

Remove suspicious programs from your startup config so they would not launch as soon as you boot your computer.

Hold Windows () key and click R key.

Enter the following in the field:

msconfig.exe

Click OK.

Go to the Startup tab and uncheck all suspicious entries.

The infected or fake startup items usually have “Unknown” listed as Manufacturer. However, sometimes they might pretend to be legitimate programs.

Check process location by hovering your mouse over the “Command” column. Navigate to the location and scan the file using virustotal.com if it looks suspicious but you are not sure.

Click OK when you are finished unselecting all potentially dangerous processes.

Step 5:

Clean up your DNS.

Press and hold Windows () key and click R key.

Enter the following in the field:

ncpa.cpl

Click OK.

It will open your current network adapters list.

Right-click on the one you currently use (unused usually have a red X near them while the active one is usually green).

Choose Properties.

Click on Internet Protocol Version 4 (ICP/IP) (make sure the checkbox is checked near it).

Click Properties.

First, select Obtain DNS server automatically.

Then click Advanced… and go to DNS tab in the newly opened window.

Remove everything from the DNS server addresses, in order of use.

Step 6:

Delete the shortcuts for all browsers on your computer as they might have been changed by an adware.

Remember that there are shortcuts not only on your Desktop but also in other places (for example, Start Menu).

Then create them again in order to have clean browser start.

Alternatively, you can click Properties on each of the shortcuts and remove any additions (usually an url) made to the Target field by the virus.

Step 7:

IMPORTANT: Now you will have to reset browser settings for each browser individually that you have installed on your computer. Alternatively, you could simply reinstall them.

 Google Chrome:

Launch the browser and select More Tools, then click Extensions.

Check for any suspicious extensions.

Click Remove From Chrome for each unwanted or suspicious toolbar or extension (the trashcan icon on the right).

Go to Settings.

Scroll to the very bottom of the settings page and click Show advanced settings…

Scroll to the very bottom again and click Reset settings.

Click Reset.

 Mozilla Firefox:

Launch the browser and go to Add-ons.

Search for any suspicious toolbars and add-ons and Remove them.

We recommend going to Options (input about:preferences in your address field and press Enter) and clicking Restore to Default near the Home Page field.

You can also completely refresh the browser settings by entering the following in the address (URL) field:

about:support

Press Enter.

Click Refresh Firefox… and then click Refresh Firefox again.

 Microsoft Edge:

Since Microsoft Edge is not a separate program and is a core component of Windows 10 you should backup your computer or at least create a Restore Point before continuing.

Navigate to the following folder (where %username is your computer user name):

C:\Users\%username\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe

Clear all contents of the folder. Click CTRL + A to select everything and delete the contents.

Click Start (Windows logo).

Search for Windows PowerShell.

Right-click on the result.

Choose Run as administrator.

Paste the following command:

Get-AppXPackage -AllUsers -Name Microsoft.MicrosoftEdge | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register $($_.InstallLocation)\AppXManifest.xml -Verbose}

Press Enter.

The settings should now be reset to default.

 Internet Explorer:

Press and hold Windows () key and click R key.

Enter the following in the field:

cmd

Click OK.

Enter the following command in the appeared window:

RunDll32.exe InetCpl.cpl,ResetIEtoDefaults

Press Enter.

Check Delete personal settings.

Click Reset.

Alternatively you can run this command to delete all caches and settings:

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

After removing the virus

When you have finished removing the adware and reverting your browser settings make sure to protect your computer by installing a good antivirus suite that would identify the threats online and in programs you have downloaded. Also, never install suspicious programs. If you are installing a new software, make sure it has nothing bundled in it by following the install wizard as well as searching for user reviews online.


Share your experience with us by leaving a comment!

Leave a comment to tell us about your experience removing this threat!
We can also help you if you run into any problems during the process, just don't hesitate to ask!

Leave a Reply

Your email address will not be published. Required fields are marked *