The ArialText font was not found" ads: what it is and how to remove it
"The ArialText font was not found" ads are deceptive malware-laden pop-ups that suggest installing a malicious file on the system. It can be a ransomware, a trojan, or another computer virus used by cybercriminals to remotely track you or to infect your PC for a specific purpose.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If notifications from bk.ru led you to download something, a free scan can check the PC for anything that came with it.
Do it yourself · free Remove The ArialText font was not found" ads yourself 2 steps, about 6 minutes, no software needed.
The ArialText font was not found" ads: summary
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Name | The ArialText font was not found" ads |
| Type | Push-notification spam site |
| Symptoms | Notification spam from a website |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 7 more facts
| Evidence | 4 write-ups by security sites; details still limited |
|---|---|
| Domains | bk.ru |
| Ads shown as | Desktop notifications |
| Browsers | Chrome, Edge and Firefox |
| Installed on the PC | Nothing; a browser notification permission only |
| First seen | 6 June 2017 |
| Facts checked | 6 October 2026 |
Is The ArialText font was not found" ads dangerous?
From our report of Jun 2017 · not reviewed since
"The ArialText font was not found" scam targets Internet Explorer users, infects them with ransomware
"The ArialText font was not found" ads are deceptive malware-laden pop-ups that suggest installing a malicious file on the system.
It can be a ransomware, a trojan, or another computer virus used by cybercriminals to remotely track you or to infect your PC for a specific purpose.
This new scam is related to RoughTed malvertising campaign and is very similar to the "The HoeflerText font wasn't found" scam . The deceptive pop-up typically appears on malicious websites that display some crippled text and trigger a "Message from webpage" pop-up that says "Microsoft Font Pack not installed!"
If the victim gets on the hook and clicks OK, the malicious web page then displays the deceptive The ArialText font was not found message and suggests that "the web page you are trying to load is displayed incorrectly, as it uses the "ArialText" font. To fix the error and display the text, you have to upload the "Microsoft Font Pack."
The fraudulent message provides the name of the manufacturer, current version of the font pack, and the "lastest version" of the required font pack version. Attentive computer users will immediately notice obvious typographic errors left in the bogus pop-up and that instantly gives an alarming sign to block "The ArialText font was not found" ads right away.
However, some users can be easily convinced that the update is required, especially when the deceptive message has a Microsoft logo on it. Clicking the "Update" button opens a window that asks what to do with the ArialFondLight.zip file, which holds the malicious payload. The ZIP archive contains a JavaScript file called ArialFont.js.
This file sends a GET request to a malicious domain sobberinfo[.]com, and downloads two files to the system - 36d4.exe (saved on the desktop) and mMSBuild.exe file in MSBuild folder in C:\ Disk. Once activated, they reveal their true origins - these are executables of the fearsome Cerber ransomware, a virus that changes data on a structural level by applying multiple encryption algorithms.
Therefore, if you notice that your web browser randomly redirects you to suspicious websites that suggest installing the ArialText or Microsoft Font Pack, quit those sites immediately and scan the system with a decent anti-malware program like to check if your PC did not get infected with any type of malware.
In case you accidentally installed the malware pushed through these deceptive pages, do not rush to pay the ransom before you check for available data backups. If you do have a data backup, implement "The ArialText font was not found" virus removal before doing anything else.
Remember - such malware is highly sophisticated and you should treat it professionally. You shouldn't even give any consideration to ransom payment option unless you cannot allow yourself to lose huge amounts of data.
Remember - scammers are not obligated to provide you with decryption tools, and they might not send it to you even after you pay the ransom. Lastly, we must remind that paying up helps criminals continue their malevolent activities with even more motivation. Ideally, do not let them involve you into their extortion schemes!
From our report of Jun 2017 · not reviewed since
Social engineering convinces victims to install malicious viruses manually
According to MalwareBreakDown blog post , the malvertising campaign was firstly spotted on rojadirecta[.]me which is an online streaming site.
The website implements repetitious redirects to several shady websites that are filled with obfuscated ad code scripts. These sites typically display a lot of deceptive pop-ups and alerts that are designed to look like real browser's informational messages. It turns out that all of the phishing websites involved in the malvertising campaign were registered on an individual whose email as onishekovich bk.ru.
After several URL redirections, the malvertising campaign lands the victim on a final site that leads to RIG exploit kit landing page. The malicious website, which functions as a gate to RIG exploit kits, displays the deceptive ArialText font message.
At the moment, it is known that the malicious pop-ups emerge for Internet Explorer users only; however, we are sure that fraudsters will improve the technique just like the HoeflerText scammers did and expand the compatibility so that Chrome and Firefox users could get scammed as well.
If you want to protect your computer from such attacks, avoid clicking on strange links online, get to know what are the most dangerous Internet websites, and install an up-to-date anti-malware program. Creating a data backup can also save your data in case of a ransomware attack, so do not hesitate and create one ASAP.
Check your browser and PC
- Address:
bk.ru
How to remove The ArialText font was not found" ads
How to stop The ArialText font was not found" ads notifications
Do this in every browser you use, and in every profile inside it: each keeps its own list of sites allowed to send notifications.
Nothing has to be uninstalled for the notifications themselves.
Which browser shows the ads?
Step 1: Remove bk.ru from Chrome's notification list
Open More (the three dots) > Settings > Privacy and security > Site settings > Notifications, or paste
chrome://settings/content/notificationsinto the address bar.Under Allowed to send notifications, open the menu next to
bk.ruand choose Remove or Block, and do the same for any other address you do not recognise.Next to Not allowed to send notifications, click Add and enter bk.ru, so the site cannot ask again. The menus are the same in Chrome on Windows 11 and Windows 10, and each Chrome profile keeps its own list.
Chrome on Windows 11: Settings > Privacy and security > Site settings > Notifications. Full procedure with screenshots: Stop website notifications and pop-ups
Step 1: Remove bk.ru from Edge's notification list
Edge stores its own permission list, separate from Chrome's, and it is often the browser behind these pop-ups on Windows 11 and Windows 10.
Go to Settings > Privacy, search, and services > Site permissions > All permissions > Notifications, or paste
edge://settings/content/notifications. Removebk.rufrom Allowed, then add it under Not allowed to send notifications. Notifications that show the Edge logo come from this list.
Edge on Windows 11: Site permissions > All permissions > Notifications. Full procedure with screenshots: Stop website notifications and pop-ups
Step 1: Remove bk.ru from Firefox's notification permissions
In Firefox the permission sits in Settings > Permissions and data > Notifications (in older versions Privacy & Security > Notifications > Settings). Select
bk.ruin the list, click Remove Website, and confirm with Save Changes.Firefox only shows these notifications while it is open, so if they stopped after closing Firefox, this is the browser to clean. The steps are the same on Windows 11 and Windows 10.
Firefox on Windows 11: the Notification Permissions window. Full procedure with screenshots: Stop website notifications and pop-ups
Then, whichever browser you use
Step 2: Scan the PC if you downloaded anything from the ads
Most people who only saw the notifications can skip this step. If a notification or the page it opened made you download or run a file, delete the file and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
More removal instructions
For programs installed on the PC and older browsers. Open the one you need.
"The ArialText font was not found" virus removal
Do not delay any longer and remove The ArialText font was not found virus right away.
If the described pop-ups appear on your screen on a daily basis, you need to know that there can be two causes why you encounter such deceptive alerts daily. You are either infected with questionable spyware or malware, or you just tend to browse through hazardous websites a lot.
Therefore, uninstalling the adware that displays them and also avoiding visiting highly untrustworthy sites is a praisable idea. The guide provided below the post introduces you to "The ArialText font was not found" removal basics.
[GI=method-1]If you feel that the web browser acts suspiciously and URL redirections occur without your intervention, you need to remove the adware/malware that causes them for you. To remove "The ArialText font was not found" ads, follow these steps.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
Questions about The ArialText font was not found" ads
Why do I get notifications from bk.ru when the browser is closed?
Chrome and Edge can keep a small part running in the background so that sites can deliver notifications, and Windows shows them in its notification area. That is why messages from bk.ru keep arriving with no browser window open.
The permission to send them was granted when someone clicked Allow on a prompt from that site, often disguised as a robot check or a video player. Closing the browser does not remove it; only the notification settings do.
Remove bk.ru from the allowed sites and the background messages stop. You can also stop the browser from running in the background in its system settings, but the permission is the real fix.
Did a notification from bk.ru infect my computer?
A notification cannot infect a PC. It is a short text with a link that the browser displays. Clicking it opens a page, and a page cannot install anything unless you agree to a download and run the file.
So the answer depends on what you did after clicking. Looked and closed: you are fine. Downloaded but did not open: delete the file.
Opened a downloaded file: uninstall what it added and scan the PC. Typed card or login details: contact the bank and change the password. In every case, remove bk.ru from the browser's allowed notifications so the messages stop.
What is The ArialText font was not found" ads?
The ArialText font was not found" ads is a push-notification spam site, a kind of adware. It earns money by showing desktop notifications, and each view, click or redirect pays whoever runs it. It is not something people usually choose; it arrives through a free download, a fake button or a misleading prompt.
The ArialText font was not found" ads does not encrypt files or take control of Windows, but its ads are sold to anyone, including scam operators, so they can lead to fake virus warnings and unwanted downloads. The steps in this guide remove it from Windows and from each browser.
Why does bk.ru keep showing up?
There are two possible reasons. If it appears as desktop notifications, a browser on this PC was given permission to receive them from bk.ru, usually through a misleading prompt. That permission stays until you remove it in the browser's site settings.
If it appears as tabs or redirects, an ad on a site you visit is opening it, or an extension or program on the PC is. Test a private window: if bk.ru never appears there, an extension is the likely cause. The plan above covers each case.
Do I have to change settings in every browser?
Only in the browsers that allowed bk.ru, but checking all of them takes a minute and is worth it. We saw the notifications in Chrome, Edge and Firefox. Chrome and Edge keep their notification lists under site settings, and Firefox under Privacy & Security > Permissions.
Remove bk.ru and any other unfamiliar site from each list, then turn off new notification requests if you do not need them. Remember that every browser profile has its own list, so a second profile can keep the messages coming after you clean the first.
Are the pop-ups I see really from The ArialText font was not found" ads?
Compare them with the details in the table above. The ArialText font was not found" ads produces desktop notifications, and the clearest sign of it is notifications from bk.ru.
Other adware looks similar, so check the name of the sending site at the bottom of a notification, the address in the tab that opened, or the newest entries on the extensions page.
If those match, this guide fits. If you see a different name, the same kind of steps apply, but remove the item you actually find rather than guessing.
Can an adware pop-up infect my PC just by appearing?
No. A pop-up, a notification or a new tab is only a web page or a message. It cannot run programs on Windows by itself, provided the browser and Windows are up to date. Infection needs a step from you:
- running a downloaded file
- installing an extension
- giving a stranger remote access
That is why scam pages work so hard to make you click. Close such pages with the tab's X or by closing the browser, not with buttons inside the page, which may start a download.
Can I turn off the pop-ups in Windows settings instead?
You can hide them, but that is not the fix. In Windows 11, Settings > System > Notifications lets you switch off notifications for a whole browser, which silences the spam together with every useful notification from that browser.
The site keeps its permission and can still send messages when you switch them back on. It is better to remove the specific site in the browser's own notification settings and block new requests. That stops the messages at the source and leaves the rest of your notifications working.
I let a "support technician" from an ad connect to my PC. What should I do?
Act quickly but calmly. Disconnect the PC from the internet first, so the connection ends. Uninstall the remote access tool they asked you to install and check Installed apps for anything else added during the call.
Run a Microsoft Defender full scan and offline scan. From another device, change your e-mail and banking passwords and sign out of all sessions.
If you paid by card, bank transfer or gift card, contact your bank or the card issuer immediately, and report the scam to the police. Do not answer if they call back.
Will Fortect remove The ArialText font was not found" ads?
No program removes The ArialText font was not found" ads itself, because there is nothing on the PC to remove: the notifications come through a permission saved in the browser, and only the browser's settings take it away, as the steps above show.
What Fortect can do is check the rest of Windows. Its free scan looks for malware, unwanted programs and damaged system files, which is useful if you clicked the ads, downloaded something from the pages they opened, or are not sure what else changed on the PC.
If the scan finds nothing and the notifications stopped after you removed the permission, this problem is solved. Use Microsoft Defender as a second opinion whenever you have downloaded files from pages like these.
Sources
- The Register: Domains tainted by RoughTed malvertising reap half a billion hits (read October 6, 2026)
- Google Chrome Help: Use notifications to get alerts (no longer online) (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)