mtextra.ttf How to remove it?

[NashX]

A few hours ago, my Kapersky Internet Security informed me that there was a trojan horse detected. Sorry, no screenshot nor description, I thought it can be handled like normal. It ask me what to do, I decide to contain and eliminate the problem. It did. Minutes later, my Kingsoft's WPS Office updated itself from Kingsoft Writer. Weird, I thought. So, I decided to uninstall the software, by Windows removal. I run Window 7, let me spec it here.

Operating System: Windows 7 Home Basic 64-bit (6.1, Build 7601) Service Pack 1 (7601.win7sp1_gdr.160211-0600)
           Language: English (Regional Setting: English)
System Manufacturer: System manufacturer
       System Model: System Product Name
               BIOS: BIOS Date: 02/17/13 14:15:28 Ver: 02.12
          Processor: Intel(R) Core(TM) i3-3240 CPU @ 3.40GHz (4 CPUs), ~3.4GHz
             Memory: 4096MB RAM
Available OS Memory: 4008MB RAM
          Page File: 3256MB used, 4756MB available
        Windows Dir: C:\Windows
    DirectX Version: DirectX 11
DX Setup Parameters: Not found
   User DPI Setting: 96 DPI (100 percent)
 System DPI Setting: 96 DPI (100 percent)
    DWM DPI Scaling: Disabled
     DxDiag Version: 6.01.7601.17514 32bit Unicode

Anyway, I noticed Kingsoft's Folder, is not deleted. I decide to manually delete everything that is not nailed down. Apparently, something is nailed down shut. Its in the Font folder, hiding in C:\Program Files (x86)\Kingsoft\Kingsoft Office\ksee\Fonts\TrueType folder. A file called: mtextra.ttf_d_23ebdc66_d_23f45e61, with Type: TTF_D_23EBDC66_D_23F45E61 File (.ttf_d_23ebdc66_d_23f45e61).
I tried to delete it, but it says "The action can't be completed because the file is open in System, Close and Try again"

And I google mtextra.tff, and all the sites have the similiar pages, like this;

Antivirus reports mtextra.ttf virus but fails to remove it? Read this page to take professional and effective guide to get rid of mtextra.ttf virus thoroughly.

mtextra.ttf Information:

    FileDescription: -
    LegalCopyright: -
    ProductName: -
    ProductVersion: -
    Company: -
    FileMd5: af9ee99ee5f6ef5cfdb7e62475990af9
    FileVersion: -
    Memos: -
    Download mtextra.ttf fix tool
    93100688

mtextra.ttf is a backdoor Trojan used to introduce other pc threats to the compromised computer. The Trojan can be downloaded to a computer via spam link, p2p software, spam email and other malware. After the Trojan invades a computer, it will exploit the system security flaw and open a back door for hackers to access the system randomly. Meanwhile, mtextra.ttf damages the computer by changing system settings, modifying HOST files, inserting malicious codes to running processes and deleting files. When the Trojan downloads additional malware from certain domains, your antivirus may fail to detect them. If you get annoying pop-up when surfing the internet, it is likely the backdoor Trojan also monitors the computer and steal sensitive information. Do you want to remove mtextra.ttf instantly? We sum up two removal methods here.

mtextra.ttf is a trojan will downloads and installs other programs furtively without users’ permission. This could include the installation of additional malware or malware components to an affected computer. The Behavior Monitoring feature observes the behavior of processes as they run programs. If it observes a process behaving in a potentially malicious way, it reports the program the process is running as potentially malicious. Most of the victims may notice that their computer will have some abnormal phenomenon like, why are their systems running slow since they start the computers? And they just launch one or two programs that their antivirus programs remind them their CPU usage is in highly burden condition. Few users may keep using their computer in this way, maybe they can live with the slowness, but as time goes by some of them may see their screen become blue screen, even they reboot systems again, without moments, and they will have the same situation. Some otherwise harmless programs may have flaws that malware or attackers can exploit to perform malicious actions. So, victims should better take seriously on this Trojan, get rid of it as soon as possible.
Tasks carried out by mtextra.ttf:

1. Opens up backdoor ports tcp 80 and udp 445
2. Make an attempt to connect to predetermined IP addresses in order to install malware downloads on to the compromised machine
3. Degrades Internet connection speed and performance to a large extent
4. Reveals user’s sensitive and confidential information such as login and password details, bank account details etc

Considering up all these malicious tasks carried out by this worm, it can be considered as one of the lethal one. So, it needs to be removed as and when detected.

mtextra.ttf–removal Guide:
Step 1: End the Process of mtextra.ttf
Hit Ctrl+Shift+Esc to enter Task Manager and then find mtextra.ttf and stop it.

Step 2: Show all hidden files.
Click : Start->Control Panel->Appearance and Personalization->Folder Option->View.
under the View tab, check Show hiden files, folders and drivers. And uncheck Hide protected operating system files (Recommended) and then click OK..

Step 3: Go to registry editor and delete related registry values:
press Win(the key between Ctrl+Alt) + R and then type regedit to enter registry.

The find the following regsitry values and delete them:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ‘random.exe’
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ‘random.exe’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce ‘random.exe’
%appdata%
%temp%

I am a bit apprehensive to use the registery editor fix and delete something called random.exe, and I noticed how vague the instruction were, especially Step 3.

Please, can someone help?
And please, teach me how, I am kinda new here.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
First of all don't mess with the Registry. Let's find out about that file.

Please go to Jotti's malware scan
(If more than one file needs scanned they must be done separately and links posted for each one)

* Copy the file path in the below Code box:

Code: [Select]

Insert File Path
* At the upload site, click once inside the window next to Browse.
* Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
* Next click Submit file
* Your file will possibly be entered into a queue which normally takes less than a minute to clear.
* This will perform a scan across multiple different virus scanning engines.
* Important: Wait for all of the scanning engines to complete.
* Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.

[NashX]

Here is the online scan results.

https://virusscan.jotti.org/en-US/filescanjob/6zun4k4602

Thanks for the quick reply.

[NashX]

Here is the online scan results.

https://virusscan.jotti.org/en-US/filescanjob/6zun4k4602

Thanks for the quick reply.

So, the scan says all green. Do I have to worry about it anymore? I asked in another forum, one poster says mtextra.ttf is a font type, and I seems to have duplicate of it in both Microsoft folder and Kingsoft folder, which was why I cannot delete the one in Kingsoft's.
And this,~

Antivirus reports mtextra.ttf virus but fails to remove it? Read this page to take professional and effective guide to get rid of mtextra.ttf virus thoroughly.

mtextra.ttf Information:

    FileDescription: -
    LegalCopyright: -
    ProductName: -
    ProductVersion: -
    Company: -
    FileMd5: af9ee99ee5f6ef5cfdb7e62475990af9
    FileVersion: -
    Memos: -
    Download mtextra.ttf fix tool
    93100688

mtextra.ttf is a backdoor Trojan used to introduce other pc threats to the compromised computer. The Trojan can be downloaded to a computer via spam link, p2p software, spam email and other malware. After the Trojan invades a computer, it will exploit the system security flaw and open a back door for hackers to access the system randomly. Meanwhile, mtextra.ttf damages the computer by changing system settings, modifying HOST files, inserting malicious codes to running processes and deleting files. When the Trojan downloads additional malware from certain domains, your antivirus may fail to detect them. If you get annoying pop-up when surfing the internet, it is likely the backdoor Trojan also monitors the computer and steal sensitive information. Do you want to remove mtextra.ttf instantly? We sum up two removal methods here.

mtextra.ttf is a trojan will downloads and installs other programs furtively without users’ permission. This could include the installation of additional malware or malware components to an affected computer. The Behavior Monitoring feature observes the behavior of processes as they run programs. If it observes a process behaving in a potentially malicious way, it reports the program the process is running as potentially malicious. Most of the victims may notice that their computer will have some abnormal phenomenon like, why are their systems running slow since they start the computers? And they just launch one or two programs that their antivirus programs remind them their CPU usage is in highly burden condition. Few users may keep using their computer in this way, maybe they can live with the slowness, but as time goes by some of them may see their screen become blue screen, even they reboot systems again, without moments, and they will have the same situation. Some otherwise harmless programs may have flaws that malware or attackers can exploit to perform malicious actions. So, victims should better take seriously on this Trojan, get rid of it as soon as possible.
Tasks carried out by mtextra.ttf:

1. Opens up backdoor ports tcp 80 and udp 445
2. Make an attempt to connect to predetermined IP addresses in order to install malware downloads on to the compromised machine
3. Degrades Internet connection speed and performance to a large extent
4. Reveals user’s sensitive and confidential information such as login and password details, bank account details etc

Considering up all these malicious tasks carried out by this worm, it can be considered as one of the lethal one. So, it needs to be removed as and when detected.

mtextra.ttf–removal Guide:
Step 1: End the Process of mtextra.ttf
Hit Ctrl+Shift+Esc to enter Task Manager and then find mtextra.ttf and stop it.

Step 2: Show all hidden files.
Click : Start->Control Panel->Appearance and Personalization->Folder Option->View.
under the View tab, check Show hiden files, folders and drivers. And uncheck Hide protected operating system files (Recommended) and then click OK..

Step 3: Go to registry editor and delete related registry values:
press Win(the key between Ctrl+Alt) + R and then type regedit to enter registry.

The find the following regsitry values and delete them:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ‘random.exe’
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ‘random.exe’
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce ‘random.exe’
%appdata%
%temp%

~is just spam on the websites I googled the term "removing mtextra.ttf" have.
If SuperDave deemed its just a false alarm that I panicked upon, then can a mod change this problem as "Solved" or do I have to change the thread manually?

[SuperDave]

That type of file just as in any other type of file could potentially infected. In this case all reports came back as being clean. You can delete the file with Unlocker.
You can download and install Unlocker .Make sure you decline each of those free offers so they won't get loaded on your computer.
Once you're satisfied with everything we can close this thread. Please let me know.

[NashX]

That type of file just as in any other type of file could potentially infected. In this case all reports came back as being clean. You can delete the file with Unlocker.
You can download and install Unlocker .Make sure you decline each of those free offers so they won't get loaded on your computer.
Once you're satisfied with everything we can close this thread. Please let me know.

Sorry, I can't find anything resembling that on that link. Only some Android apps and IOBit Unlocker and Unlocker Tool. Was the last two like the one you said?

[NashX]

I tried IOBit Unlocker, it didn't work. Just delete the file temporarily, and when I refresh the folder, the file is still there.

[SuperDave]

Just delete the file temporarily, and when I refresh the folder, the file is still there.

So, I decided to uninstall the software

You said you uninstalled the program??
Unlocker is right there at the top but you will need to uninstall the program the proper way through the Control Panel.Sometimes, some programs have their own uninstaller.