Adware Jolly Wallet. How to delete?

Discussion in 'Mac Apps and Mac App Store' started by Boosted300, Aug 22, 2013.

  1. Boosted300, Aug 22, 2013
    Last edited: Aug 22, 2013

    Boosted300 macrumors newbie

    Joined:
    Aug 22, 2013
    #1
    Hey guys new to the forums, i've never had an adware/malware/virus issue on my Mac, but recently I keep getting a bar in Chrome for a company called Jollywallet. I haven't installed any software recently, so I'm not sure were I got it from. It only comes on ecommerce websites.

    I have tried checking chrome extensions, chrome task manger, mac applications, activity monitor. Also deleted chrome using AppCleaner and reinstalled. Tried googling for days and found info only for PCs. Scanned with Sophos aswell.

    Any ideas on what I can do?

    This is what it looks like.

    [​IMG]
     
  2. DarkSel macrumors regular

    Joined:
    Dec 22, 2012
    #2
    Pretty sure that's just an advertisement.

    It's definitely not a chrome toolbar.
     
  3. Boosted300 thread starter macrumors newbie

    Joined:
    Aug 22, 2013
    #3
    But it happens on all ecommerce sites. I'm pretty sure amazon wouldn't put that on their home page.
     
  4. NewbieCanada macrumors 68030

    Joined:
    Oct 9, 2007
    #4
    It’s definitely adware - I’ve found instructions for removing it on Windows systems, but can’t find any for Macs.
     
  5. Boosted300 thread starter macrumors newbie

    Joined:
    Aug 22, 2013
    #5
    Definitely. I cant be the only one with this issue.
     
  6. sofianito macrumors 65816

    sofianito

    Joined:
    Jan 14, 2011
    Location:
    Spain
    #6
    I just accessed JollyWallet website. It is an Chrome extension. You can find it at: https://chrome.google.com/webstore/detail/jollywallet/fhogchfgdonibfhhcalbaaejfoopigik


    What are Chrome's current extensions? Check it with Chrome GUI.

    The other way is to open terminal command and run ls command of directory ~/Library/Application Support/Google/Chrome/Default/Extensions

    You'll see cryptic directory names such as:
    Code:
    drwx------@  3 sofianito  staff   102 Jun 27 03:16 [B]pjkljhegncpnkpknbcohdijeoejaedia[/B]
    drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]coobgpohoikkiipiblmjeljniedjpjpf[/B]
    drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]blpcfgokakmgnkcojhhkbfbldkacnbeo[/B]
    drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]apdfllckaahabafndbhieahigkjlhalf[/B]
    drwx------@  3 sofianito  staff   102 Jun 28 00:27 [B]aohghmighlieiainnegkcijnfilokake[/B]
    drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]cdllihdpcibkhhkidaicoeeiammjkokm[/B]
    drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]aoppafgebigncioehnmdmljdmjiipigk[/B]
    drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]iphcomljdfghbkdcfndaijbokpgddeno[/B]
    drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]kdincancfhbjbhigncdpbgocllncidma[/B]
    drwx------@  3 sofianito  staff   102 Jul  4 12:10 [B]jejjnakkloifblihgfppdabbeeedgion[/B]
    .
    .
    .
    
    These cryptic folder names are the names or IDs of installed extensions. Check if JollyWallet extension ID (see above in red) is listed...
     
  7. Boosted300 thread starter macrumors newbie

    Joined:
    Aug 22, 2013
    #7
    Thanks for the response. JollyWallet does not show up in the Extensions GUI, nor does it show up in Terminal.

    These are my extensions that are showing up.

    aohghmighlieiainnegkcijnfilokake hdokiejnpimakedhajhdlcegeplioahd
    apdfllckaahabafndbhieahigkjlhalf ibfamoapbmmmlknoopmmfofgladlinic
    bfbmjmiodbnnpllbbbfblcplfjjepjdn icdipabjmbhpdkjaihfjoikhjjeneebd
    blpcfgokakmgnkcojhhkbfbldkacnbeo jnihajbhpnppcggbcgedagnkighmdlei
    chklaanhfefbnpoihckbnefhakgolnmc kgcbemnjmjdplnanhpjkmapflmbmoggm
    coobgpohoikkiipiblmjeljniedjpjpf kkelicaakdanhinjdeammmilcgefonfh
    dkfhfaphfkopdgpbfkebjfcblcafcmpi ldpjmcifldgbmbnaomjgefifpedcakme
    ejpepffjfmamnambagiibghpglaidiec mihcahmgecmbnbcchbopgniflfhgnkff
    fbangkleohkafngihneedemihgfeikcl nmmhkkegccagdldgiimedpiccmgmieda
    fkkaebihfmbofclegkcfkkemepfehibg pjkljhegncpnkpknbcohdijeoejaedia
    gighmmpiobklfepjocnamgkkbiglidom

    ----------

    I just realized, I only have 11 extensions that I installed, but in Terminal it is showing up 10 more?!
     
  8. sofianito macrumors 65816

    sofianito

    Joined:
    Jan 14, 2011
    Location:
    Spain
    #8
    They might be internal extensions...

    I am running out of ideas... I would help you and install the adware extensions to see how to get rid of it but I am a bit busy. If I find some spare time I'd gladly help...

    Cheers.
     
  9. old-wiz macrumors G3

    Joined:
    Mar 26, 2008
    Location:
    West Suburban Boston Ma
    #9
    Does it not show up in Google Chrome -> Windows -> Extensions? All extensions should show up there and be you should be able to disable/remove them.
     
  10. sofianito macrumors 65816

    sofianito

    Joined:
    Jan 14, 2011
    Location:
    Spain
    #10
    I just installed and uninstalled the jolly wallet adware chrome extension, and verified that the annoying adware message disappears after uninstalling the extension.
     
  11. Boosted300 thread starter macrumors newbie

    Joined:
    Aug 22, 2013
    #11
    I installed it and uninstalled it, lets see when happens. I will post when I go on other ecommerce sites.
     
  12. sofianito macrumors 65816

    sofianito

    Joined:
    Jan 14, 2011
    Location:
    Spain
    #12
    Try to access Best Buy website. If doesn't appear then it's gone...
     
  13. jowie macrumors 6502a

    Joined:
    Jun 9, 2004
    Location:
    London ish
    #13
    Mine added itself to the Apple Discussions Forum website! However, it had a "Remove" button so I clicked on it and it has gone. Hope it doesn't come back!:confused:
     
  14. 0011 macrumors newbie

    Joined:
    Nov 23, 2013
    #14
    [Solution] Disable Chrome Extension Webpage Screenshot Capture

    It appears that this comes back every time I load the Apple website.

    I've disabled my extensions/plugins one at a time and determined that this is caused by "Webpage Screenshot Capture".

    To disable go to Window > Extensions > Scroll down until you see "Webpage Screenshot Capture" > Uncheck "Enable".

    I'm never using this plugin.

    Note: This appears to only display on the http version of the site, not the https version.
     
  15. dmalone, Dec 5, 2013
    Last edited: Dec 5, 2013

    dmalone macrumors newbie

    Joined:
    Dec 5, 2013
    #15
    Nice work. I have had that extension installed for a long time and Jolly Wallet just starting popping up on me. Uninstalled the extension and fixed. Thank you sir.

     
  16. Accretor macrumors newbie

    Joined:
    Dec 9, 2013
    #16
    Yep, definitely Webpage Screenshot. According to the changelog, this treat was added just recently to the extension. I have now uninstalled. Skitch is better anyway. Thanks for the solution!

    :)
     
  17. Milk123 macrumors newbie

    Joined:
    Dec 9, 2013
    #17
    [Solution] Disable jolly in the extension settings

    I discovered that there is a new option in the extension itself, to remove(disable) jollywallet :)
     
  18. lefos macrumors newbie

    Joined:
    Jan 26, 2009
    Location:
    New Jersey
    #18
    the extension has a different name

    I had the same issue and came to the conclusion that the extension causing the jollywallet banner to display was something called "Webpage Screenshot". Removing that extension resolved my issue.
     
  19. PiedType macrumors newbie

    Joined:
    Jan 19, 2014
    Location:
    Denver
    #19
    Dump "Webpage Screenshot Capture"

    Just confirming that removing the Chrome extension called "Webpage Screenshot Capture" got rid of the JollyWallet pop-ups. I was told there's a setting within the extension to turn off JollyWallet, but by then I'd already deleted the extension.
     
  20. Bear macrumors G3

    Joined:
    Jul 23, 2002
    Location:
    Sol III - Terra
    #20
  21. peterzachos macrumors newbie

    Joined:
    Jan 19, 2014
    #21
    Adware additions

    Bear is absolutely right. Months and months ago I mindlessly installed an extension that purported to remove YouTube playback ads. I immediately noticed Ownza and JollyWallet popups on commerce sites. Once I removed that extension, they never appeared again.

    - peter z.
     
  22. blackwidowee macrumors newbie

    Joined:
    Mar 7, 2013
    #22
    Watch for 3rd party extensions

    I was shocked to see the Jolly Wallet at the online Apple store. I thought I had hit a bogus URL.

    Thanks for the information. Looking at "recently" added extensions and disabling them, I discovered it was "Weather (Fahrenheit) 3.67". It was then deleted.
     
  23. Johnchapin macrumors member

    Joined:
    Jun 8, 2008
    Location:
    Boulder
    #23
    I'm new to all this. It seems popovers got really obtrusive in recent weeks. So, I chanced upon a Firefox addition called NoScript. You have to choose which scripts to allow, but they are usually fairly obvious by their names, and ones like Jolly Wallet are to be avoided.
     

Share This Page