Adware Jolly Wallet. How to delete?

[Boosted300]

Hey guys new to the forums, i've never had an adware/malware/virus issue on my Mac, but recently I keep getting a bar in Chrome for a company called Jollywallet. I haven't installed any software recently, so I'm not sure were I got it from. It only comes on ecommerce websites.

I have tried checking chrome extensions, chrome task manger, mac applications, activity monitor. Also deleted chrome using AppCleaner and reinstalled. Tried googling for days and found info only for PCs. Scanned with Sophos aswell.

Any ideas on what I can do?

This is what it looks like.

 

[DarkSel]

Hey guys new to the forums, i've never had an adware/malware/virus issue on my Mac, but recently I keep getting a bar in Chrome for a company called Jollywallet. I haven't installed any software recently, so I'm not sure were I got it from. It only comes on ecommerce websites.

I have tried checking chrome extensions, chrome task manger, mac applications, activity monitor. Also deleted chrome using AppCleaner and reinstalled. Tried googling for days and found info only for PCs. Scanned with Sophos aswell.

Any ideas on what I can do?

This is what it looks like.

Image

Pretty sure that's just an advertisement.

It's definitely not a chrome toolbar.

 

[Boosted300]

But it happens on all ecommerce sites. I'm pretty sure amazon wouldn't put that on their home page.

 

[NewbieCanada]

It’s definitely adware - I’ve found instructions for removing it on Windows systems, but can’t find any for Macs.

 

[Boosted300]

It’s definitely adware - I’ve found instructions for removing it on Windows systems, but can’t find any for Macs.

Definitely. I cant be the only one with this issue.

 

[sofianito]

I just accessed JollyWallet website. It is an Chrome extension. You can find it at: https://chrome.google.com/webstore/detail/jollywallet/fhogchfgdonibfhhcalbaaejfoopigik


What are Chrome's current extensions? Check it with Chrome GUI.

The other way is to open terminal command and run ls command of directory ~/Library/Application Support/Google/Chrome/Default/Extensions

You'll see cryptic directory names such as:

drwx------@  3 sofianito  staff   102 Jun 27 03:16 [B]pjkljhegncpnkpknbcohdijeoejaedia[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]coobgpohoikkiipiblmjeljniedjpjpf[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]blpcfgokakmgnkcojhhkbfbldkacnbeo[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]apdfllckaahabafndbhieahigkjlhalf[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]aohghmighlieiainnegkcijnfilokake[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]cdllihdpcibkhhkidaicoeeiammjkokm[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]aoppafgebigncioehnmdmljdmjiipigk[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]iphcomljdfghbkdcfndaijbokpgddeno[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]kdincancfhbjbhigncdpbgocllncidma[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]jejjnakkloifblihgfppdabbeeedgion[/B]
.
.
.

These cryptic folder names are the names or IDs of installed extensions. Check if JollyWallet extension ID (see above in red) is listed...

 

[Boosted300]

I just accessed JollyWallet website. It is an Chrome extension. You can find it at: https://chrome.google.com/webstore/detail/jollywallet/fhogchfgdonibfhhcalbaaejfoopigik


What are Chrome's current extensions? Check it with Chrome GUI.

The other way is to open terminal command and run ls command of directory ~/Library/Application Support/Google/Chrome/Default/Extensions

You'll see cryptic directory names such as:

drwx------@  3 sofianito  staff   102 Jun 27 03:16 [B]pjkljhegncpnkpknbcohdijeoejaedia[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]coobgpohoikkiipiblmjeljniedjpjpf[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]blpcfgokakmgnkcojhhkbfbldkacnbeo[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]apdfllckaahabafndbhieahigkjlhalf[/B]
drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]aohghmighlieiainnegkcijnfilokake[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]cdllihdpcibkhhkidaicoeeiammjkokm[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]aoppafgebigncioehnmdmljdmjiipigk[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]iphcomljdfghbkdcfndaijbokpgddeno[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]kdincancfhbjbhigncdpbgocllncidma[/B]
drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]jejjnakkloifblihgfppdabbeeedgion[/B]
.
.
.

These cryptic folder names are the names or IDs of installed extensions. Check if JollyWallet extension ID (see above in red) is listed...

Thanks for the response. JollyWallet does not show up in the Extensions GUI, nor does it show up in Terminal.

These are my extensions that are showing up.

aohghmighlieiainnegkcijnfilokake hdokiejnpimakedhajhdlcegeplioahd
apdfllckaahabafndbhieahigkjlhalf ibfamoapbmmmlknoopmmfofgladlinic
bfbmjmiodbnnpllbbbfblcplfjjepjdn icdipabjmbhpdkjaihfjoikhjjeneebd
blpcfgokakmgnkcojhhkbfbldkacnbeo jnihajbhpnppcggbcgedagnkighmdlei
chklaanhfefbnpoihckbnefhakgolnmc kgcbemnjmjdplnanhpjkmapflmbmoggm
coobgpohoikkiipiblmjeljniedjpjpf kkelicaakdanhinjdeammmilcgefonfh
dkfhfaphfkopdgpbfkebjfcblcafcmpi ldpjmcifldgbmbnaomjgefifpedcakme
ejpepffjfmamnambagiibghpglaidiec mihcahmgecmbnbcchbopgniflfhgnkff
fbangkleohkafngihneedemihgfeikcl nmmhkkegccagdldgiimedpiccmgmieda
fkkaebihfmbofclegkcfkkemepfehibg pjkljhegncpnkpknbcohdijeoejaedia
gighmmpiobklfepjocnamgkkbiglidom

----------

I just realized, I only have 11 extensions that I installed, but in Terminal it is showing up 10 more?!

 

[sofianito]

Thanks for the response. JollyWallet does not show up in the Extensions GUI, nor does it show up in Terminal.

These are my extensions that are showing up.

aohghmighlieiainnegkcijnfilokake hdokiejnpimakedhajhdlcegeplioahd
apdfllckaahabafndbhieahigkjlhalf ibfamoapbmmmlknoopmmfofgladlinic
bfbmjmiodbnnpllbbbfblcplfjjepjdn icdipabjmbhpdkjaihfjoikhjjeneebd
blpcfgokakmgnkcojhhkbfbldkacnbeo jnihajbhpnppcggbcgedagnkighmdlei
chklaanhfefbnpoihckbnefhakgolnmc kgcbemnjmjdplnanhpjkmapflmbmoggm
coobgpohoikkiipiblmjeljniedjpjpf kkelicaakdanhinjdeammmilcgefonfh
dkfhfaphfkopdgpbfkebjfcblcafcmpi ldpjmcifldgbmbnaomjgefifpedcakme
ejpepffjfmamnambagiibghpglaidiec mihcahmgecmbnbcchbopgniflfhgnkff
fbangkleohkafngihneedemihgfeikcl nmmhkkegccagdldgiimedpiccmgmieda
fkkaebihfmbofclegkcfkkemepfehibg pjkljhegncpnkpknbcohdijeoejaedia
gighmmpiobklfepjocnamgkkbiglidom

----------

I just realized, I only have 11 extensions that I installed, but in Terminal it is showing up 10 more?!

They might be internal extensions...

I am running out of ideas... I would help you and install the adware extensions to see how to get rid of it but I am a bit busy. If I find some spare time I'd gladly help...

Cheers.

 

[old-wiz]

Does it not show up in Google Chrome -> Windows -> Extensions? All extensions should show up there and be you should be able to disable/remove them.

 

[sofianito]

I just installed and uninstalled the jolly wallet adware chrome extension, and verified that the annoying adware message disappears after uninstalling the extension.

 

[Boosted300]

I installed it and uninstalled it, lets see when happens. I will post when I go on other ecommerce sites.

 

[sofianito]

Try to access Best Buy website. If doesn't appear then it's gone...

 

[jowie]

Mine added itself to the Apple Discussions Forum website! However, it had a "Remove" button so I clicked on it and it has gone. Hope it doesn't come back!

 

[0011]

[Solution] Disable Chrome Extension Webpage Screenshot Capture

It appears that this comes back every time I load the Apple website.

I've disabled my extensions/plugins one at a time and determined that this is caused by "Webpage Screenshot Capture".

To disable go to Window > Extensions > Scroll down until you see "Webpage Screenshot Capture" > Uncheck "Enable".

I'm never using this plugin.

Note: This appears to only display on the http version of the site, not the https version.

 

[dmalone]

Nice work. I have had that extension installed for a long time and Jolly Wallet just starting popping up on me. Uninstalled the extension and fixed. Thank you sir.

It appears that this comes back every time I load the Apple website.

I've disabled my extensions/plugins one at a time and determined that this is caused by "Webpage Screenshot Capture".

To disable go to Window > Extensions > Scroll down until you see "Webpage Screenshot Capture" > Uncheck "Enable".

I'm never using this plugin.

Note: This appears to only display on the http version of the site, not the https version.

 

[Accretor]

Yep, definitely Webpage Screenshot. According to the changelog, this treat was added just recently to the extension. I have now uninstalled. Skitch is better anyway. Thanks for the solution!

 

[Milk123]

[Solution] Disable jolly in the extension settings

I discovered that there is a new option in the extension itself, to remove(disable) jollywallet

 

[lefos]

the extension has a different name

I had the same issue and came to the conclusion that the extension causing the jollywallet banner to display was something called "Webpage Screenshot". Removing that extension resolved my issue.

 

[PiedType]

Dump "Webpage Screenshot Capture"

Just confirming that removing the Chrome extension called "Webpage Screenshot Capture" got rid of the JollyWallet pop-ups. I was told there's a setting within the extension to turn off JollyWallet, but by then I'd already deleted the extension.

 

[Bear]

I suspect what you're all seeing is partially because of Adware vendors buy Chrome Extensions to send ad- and malware-filled updates.

Basically if an extension you use was bought by an adware company, the autoupdate gives you the adware addition.

 

[peterzachos]

Adware additions

Bear is absolutely right. Months and months ago I mindlessly installed an extension that purported to remove YouTube playback ads. I immediately noticed Ownza and JollyWallet popups on commerce sites. Once I removed that extension, they never appeared again.

- peter z.

 

[blackwidowee]

Watch for 3rd party extensions

I was shocked to see the Jolly Wallet at the online Apple store. I thought I had hit a bogus URL.

Thanks for the information. Looking at "recently" added extensions and disabling them, I discovered it was "Weather (Fahrenheit) 3.67". It was then deleted.

 

[Johnchapin]

I'm new to all this. It seems popovers got really obtrusive in recent weeks. So, I chanced upon a Firefox addition called NoScript. You have to choose which scripts to allow, but they are usually fairly obvious by their names, and ones like Jolly Wallet are to be avoided.