NG Player Mac Malware - How to remove

NG Player, or NG Media Player, is a video player for Macs. It is considered to be adware, so it ought to be avoided. That’s hard to do, though, as NG Player often leads people to download it unintentionally. Once NG Player is installed, it can be difficult to remove, too.

Here is a scan of one of NG Player’s installers  – Virustotal.com. This doesn’t bode well.

About NG Player:

Type of threat	Adware, potentially unwanted program.
Problems and issues	It gets downloaded unintentionally, it may download adware and other unwanted apps.
How NG Player spreads	Advertised online (often dishonestly, in a way that causes misunderstandings), downloaded from its own website.
How to remove NG Player	Delete suspicious apps, detect and remove malware with Combo Cleaner and other anti-malware tools, restore system settings, delete malicious files.

Problems with NG Player

Unintentional installation

NG Player has its websites that you can download it from – Ngmacmediaplayer.com and Ngmacplayer.com.

But, if you look up NG Player online, you can find stories of people who downloaded NG Player accidentally, without knowing about it, or were demanded it by a website. This is a red flag. Apps that sneak in uninvited or trick people into downloading them usually aren’t worth using.

Bundled with other apps

NG Player often gets labeled as Malware, Adware, but mostly as InstallCore or InstallMiez. InstallCore is a type of monetization where one app’s installer offers other apps.

In other words, it’s an app that makes money by offering additional apps. If you install it, you might end up with a couple of other apps that you may not have wanted (both legitimate and malicious). It’s how NG Player may have been installed, but it may also be used by NG Player to install other apps – depending on where you got NG Player from.

While the installer should clearly warn you about NG Player being included, it doesn’t always do it. The warnings may be displayed on an optional settings page or hidden in walls of text. As a result, you might install NG Player without noticing it.

NG Player may bundle PDF Expert, PDF Mac Master, or something similar. They seem to be related.

Advertised dishonestly

Sometimes, NG Player appears in ads online.

Some ads look like macOS notifications – the ones that show up in the upper right corner of your screen. That’s pretty dishonest, as you might mistake the ads for actual system notifications. Of course, lots of shady sites show ads like that (I see such ads for MacKeeper very often).

I’ve also noticed people say that they were asked to install NG Player in order to view a webpage or download a file or an app. Such ads are common on file download sites. They’re fake ads or warnings (just like those fake Flash Player updates) that can be freely ignored, but they are made to look serious, and so people take them seriously.

It’s not just sites that knowingly show obnoxious ads that can spread NG Player. Smaller sites sometimes get their ads infected or malicious code injected by cybercriminals, causing them to spread malware.

Additional malware

Based on Virustotal.com’s scans of various NG Player installers and their bundled files, NG Player may bring into your system:

• Downloaders and trojans – apps that download other malicious apps. This can cause unfamiliar changes to your system (like new apps) at unexpected times (when you didn’t install anything).
• Adware. These are apps and browser extensions that change how your internet works and how your browser behaves. They display ads and open unexpected websites.
• Spyware. Some apps just collect data about your web browsing activities. Some of them can see sensitive data like passwords.

That’s why there are complaints online about NG Player changing people’s search engine to Yahoo (Discussions.apple.com) – adware installed with NG Player takes over the browser. You can read more in our post Yahoo redirect virus or, for a more in-depth analysis, Google redirect.

How to remove NG Player

Remove all unwanted apps

I recommend checking your computer for other threats besides NG Player. Malicious software that could have been installed by NG Player or alongside it.

After you remove all the threats from your computer, you should probably reset your passwords for your online accounts, just in case some spyware read them.

Go to Finder, Applications, and delete all suspicious apps that were installed recently. Scan your Mac with an anti-malware app, like Combo Cleaner. You may have to reboot your Mac in safe mode (reboot and then hold Shift until you see “Safe Boot” written in the corner of your screen). Without safe mode, NG Player and other apps might be running and refuse to be deleted.

NG Player appears to be more serious than your usual adware, so here are some steps to take when removing malware from a Mac.

Change system settings

Hijacked settings could be used by malware to change your browser settings, to hijack your internet traffic, and to run unwanted programs on startup.

Open System Preferences. You can find it in your Dock or the Apple menu:

• Open Users & Groups, Login Items. Remove all unknown and unwanted items (select them and click the minus ‘-‘ button at the bottom of the window).
• Open Profiles (if the icon is there). Remove all the unfamiliar items.
• Go to Network, Advanced, Proxies. In the table on the left, if an unfamiliar protocol is selected and you didn’t set it up, deselect and click OK.

Delete unwanted files

NG Player may have brought some unwanted files and hidden them in Library folders. Finding them is better done with an anti-malware scanner, but you can also review these files manually. Just be careful as these folders hold files used by your legitimate apps, too.

1. Open Finder.
2. Open its Go menu and select Go to Folder in the drop-down.
3. Type in the names ~/Library/LaunchAgents, ~/Library/Application Support, /Library/Application Support, and /Library/LaunchDaemons one-by-one and visit each of these folders.
4. Find and delete suspicious files that you find in them. If you aren’t sure, ask for advice on Apple’s forums.

Reboot your Mac normally to get out of safe mode.

Automatic Malware removal tools