Jollywallet

Jollywallet Description

Jollywallet is an adware threat that is known for displaying annoying pop-up advertisements that attempt to offer online shopping savings deals. These pop-up messages from Jollywallet usually display randomly and lead to unwanted sites when clicked on. Jollywallet may be installed with bundled software where it will run in the background while displaying a toolbar offering shopping and sharing features. Uninstalling Jollywallet is usually a difficult process as it is not clearly marked within the list of installed apps through the Windows control panel.

Infected with Jollywallet? Scan Your PC for Free

Download SpyHunter’s Spyware Scanner
to Detect Jollywallet

Security Doesn't Let You Download SpyHunter or Access the Internet?


Solutions: Your computer may have malware hiding in memory that prevents any program, including SpyHunter, from executing on your computer. Follow to download SpyHunter and gain access to the Internet:
  • Use an alternative browser. Malware may disable your browser. If you're using IE, for example, and having problems downloading SpyHunter, you should open Firefox, Chrome or Safari browser instead.
  • Use a removable media. Download SpyHunter on another clean computer, burn it to a USB flash drive, DVD/CD, or any preferred removable media, then install it on your infected computer and run SpyHunter's malware scanner.
  • Start Windows in Safe Mode. If you can not access your Window's desktop, reboot your computer in 'Safe Mode with Networking' and install SpyHunter in Safe Mode.
  • IE Users: Disable proxy server for Internet Explorer to browse the web with Internet Explorer or update your anti-spyware program. Malware modifies your Windows settings to use a proxy server to prevent you from browsing the web with IE.

If you still can't install SpyHunter? View other possible causes of installation issues.

Technical Information

Infection Statistics


Our MalwareTracker shows malware activity across the world. Explore real-time data of Jollywallet outbreaks and other threats from global to local level.

File System Details

Jollywallet creates the following file(s):
# File Name Size MD5 Detection Count
1 jollywallet_99_2.exe 2,720,120 0f17f7e4a7fd45360b92e3cfb312dea4 141
2 http_www.jollywallet.com_0.localstorage 131
3 http_www.jollywallet.com_0.localstorage-journal 128
4 chrome-extension_nebgmadhfahbjejndohjkhofghapnhhl_0.localstorage-journal 84
5 chrome-extension_nebgmadhfahbjejndohjkhofghapnhhl_0.localstorage 81
6 %PROGRAMFILES(x86)%\JollyWallet 78
7 %UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\jiekonljbeipfklhchhdjddejaennfnl 78
8 %PROGRAMFILES%\JollyWallet 75
9 %UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\fhogchfgdonibfhhcalbaaejfoopigik 75
10 %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\nebgmadhfahbjejndohjkhofghapnhhl 72
11 %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\fhogchfgdonibfhhcalbaaejfoopigik 72
12 %UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fhogchfgdonibfhhcalbaaejfoopigik 69
13 %UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nebgmadhfahbjejndohjkhofghapnhhl 69
14 %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\fhogchfgdonibfhhcalbaaejfoopigik 66
15 %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\jiekonljbeipfklhchhdjddejaennfnl 66

More files

Registry Details

Jollywallet creates the following registry entry or registry entries:
HKEY..\..\..\..{RegistryKeys}
Classes\CrossriderApp0012555.Sandbox
CrossriderApp0012555.BHO
CrossriderApp0012555.BHO.1
CrossriderApp0012555.Sandbox
CrossriderApp0012555.Sandbox.1
Software\AppDataLow\Software\Crossrider\Button, value: 12555
Software\AppDataLow\Software\Crossrider\onBeforeNavigate, value: 12555
Software\AppDataLow\Software\JollyWallet
SOFTWARE\Classes\CrossriderApp0012555.BHO.1
SOFTWARE\Classes\CrossriderApp0012555.Sandbox
SOFTWARE\Classes\CrossriderApp0012555.Sandbox.1
SOFTWARE\Classes\CrossriderApp0012555.Sandbox\CLSID
SOFTWARE\Classes\CrossriderApp0012555.Sandbox\CurVer
Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\jollywallet
Software\Cr_Installer\12555
Software\InstalledBrowserExtensions\JollyWallet
SOFTWARE\jollywallet
Software\Microsoft\Internet Explorer\DOMStorage\www.jollywallet.com
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{10cc38fa-ad05-4a05-9fdc-13a446f52479}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{168BB8EE-D7EB-44EA-B648-6FF73214E920}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1B22F224-8590-451C-BC76-DD27FD1499D}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{261D84FC-B50F-4C56-A053-9E7F78DF733}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{34318AA6-B3BC-424B-956A-7FA0C68383D}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3F08EA8-D796-4C33-926F-75752F6222}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4117F85F-CFA5-4A33-8DA8-A55CA75E1BD9}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{447e0f33-6fc6-4319-8bf1-f8362dad8f96}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{45ac67d3-cae7-4933-9952-4f821d417b65}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49087B79-E927-41AA-A7F7-A9CAFF8D71F}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{66E1844A-2B-4B87-AF30-B8F778249AF4}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70aec5e4-86b8-436a-aaac-03108f59c3fe}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76C0B4E8-5CE2-450B-91E6-B3968B8DC1DC}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7b26e61c-045a-4607-82af-995a89b789f4}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7B4B949E-5695-46EE-B62C-97E8925C86AF}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8222a660-d4ac-4784-bfcd-722ca2c11f1e}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{85F275E6-5B4C-4C79-A0BC-B4EA964A5A9A}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8A187BE9-5417-46CC-A951-62F3EF7752DB}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8af48b06-c98c-4715-b165-82888825bebd}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{944E382F-667-429D-8473-C5421FC7A4A3}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a145492a-f863-48e6-be47-a91d1a0e673a}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B114175-7FEF-4045-8E84-E18B731B2219}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b1164e1f-e6b1-4339-a71f-75327a250368}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BCB55AE3-2D50-477D-90F6-ED5888448E8}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CBC8DEE9-4A3A-45DD-869B-18C66368AB98}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCD8204C-53FF-442F-B91C-48C2ADA78C32}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ce6c9745-5ad7-4f85-a9c0-2f67c8801385}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D05EFAB9-CB11-4756-94F7-5E777AF0B569}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D418E83A-C620-4F92-B8BC-401B39FD8093}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d41f9bdf-97dd-4f7b-9841-4a8d2fe93269}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ea70b16d-cbe2-4827-a096-876a84654504}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F08CCD15-A44D-4BDC-8F46-A8435288B035}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F0B842F8-F533-4CF5-BE1B-5718A3F4CA28}
Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fc99a044-110b-468f-a977-724a8cf1b650}
SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION, value: jollywallet-bg.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater12555.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID, value: {11111111-1111-1111-1111-110111251155}
SOFTWARE\Wow6432Node\jollywallet
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{10cc38fa-ad05-4a05-9fdc-13a446f52479}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111251155}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111251155}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{447e0f33-6fc6-4319-8bf1-f8362dad8f96}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44c974cf-73c3-44a3-bc29-32c51f045ed9}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{45ac67d3-cae7-4933-9952-4f821d417b65}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70aec5e4-86b8-436a-aaac-03108f59c3fe}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7b26e61c-045a-4607-82af-995a89b789f4}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ce6c9745-5ad7-4f85-a9c0-2f67c8801385}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d41f9bdf-97dd-4f7b-9841-4a8d2fe93269}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{dfd7d9b1-1cc1-4d8a-bf44-b9879446a65d}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fc99a044-110b-468f-a977-724a8cf1b650}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION, value: jollywallet-bg.exe
SOFTWARE\Wow6432Node\Microsoft\Tracing\JollyWallet-InternalInstaller_RASAPI32
SOFTWARE\Wow6432Node\Microsoft\Tracing\JollyWallet-InternalInstaller_RASMANCS
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\jollywallet
HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}
JollyWallet
The following CLSID's were found:
HKEY..\..\{CLSID Path}
{22222222-2222-2222-2222-220122252255}
{11111111-1111-1111-1111-110111251155}
{44444444-4444-4444-4444-440144254455}
{66666666-6666-6666-6666-660166256655}
{55555555-5555-5555-5555-550155255555}

Site Disclaimer

Leave a Reply

IMPORTANT! To be able to proceed, you need to solve the following simple math.
Please leave these two fields as-is:
What is 8 + 9 ?