{"id":18100,"date":"2026-07-21T09:54:11","date_gmt":"2026-07-21T16:54:11","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=18100"},"modified":"2026-07-21T10:07:30","modified_gmt":"2026-07-21T17:07:30","slug":"lg-monitors-spotted-installing-adware-like-app-on-windows-pcs","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/07\/21\/lg-monitors-spotted-installing-adware-like-app-on-windows-pcs\/","title":{"rendered":"LG Monitors Spotted Installing Adware-Like App on Windows PCs"},"content":{"rendered":"\n

This reminds me of the old Sony Rootkit that was installed from a music CD, showing just how little respect these megacorps have for you. My LG monitor is quite old, but Arch pacman doesn’t install things without me seeing and approving them… And yet another reason to ditch Microsoft products, though the GDID and tracking everything you do<\/a> should have been enough already.<\/p>\n\n\n\n

https:\/\/hackread.com\/lg-monitors-install-adware-app-windows-pcs\/<\/a><\/p>\n\n\n

<\/div><\/div><\/div>\n\n\n
\"\"<\/figure>\n\n\n\n
Connecting certain LG monitors prompts Windows Update to install an LG app without consent, while the software runs at startup and displays McAfee trial adverts.<\/h5>\n\n\n\n

By Waqas<\/p>\n\n\n\n

LG is facing criticism after users found that connecting certain LG monitors<\/a> to Windows PCs can automatically install an application that promotes paid McAfee antivirus subscriptions. The LG Monitor App Installer arrives through Windows Update<\/a> without an approval prompt, and the first visible interaction may be an advertisement.<\/p>\n\n\n\n

Windows begins the download after identifying the connected display and retrieving LG<\/a> extension and software component packages. The process then installs the application from the Microsoft Store, where its listed capabilities include internet access and the ability to use all system resources.<\/p>\n\n\n\n

McAfee Ads Appear Without Prior Consent<\/strong><\/h3>\n\n\n\n

Popular YouTube channel Gamers Nexus reproduced the process using an LG UltraGear 34GX900A-B. Windows Reliability Monitor showed the LG Monitor App Installer arriving about one minute after Windows Update installed the associated LG packages, with no installation request or consent screen.<\/p>\n\n\n\n

During 32 consecutive system boots, the application displayed a McAfee promotion 31 times. The remaining boot promoted one of LG\u2019s monitor utilities. According to VideoCardz<\/a>, the McAfee offer provides a 30-day trial that later converts into a paid subscription.<\/p>\n\n\n\n

Once installed, the application registers itself to run when Windows starts. This allows its promotional messages to return after subsequent reboots, even though the owner never requested the software.<\/p>\n\n\n\n

\"\"<\/a>
Actual popup (Image via Gamers Nexus)<\/figcaption><\/figure>\n\n\n\n

LG App Runs Outside the Windows App Sandbox<\/strong><\/h3>\n\n\n\n

The Microsoft Store listing says LG Monitor App Installer can access the internet and use \u201call system resources.\u201d Microsoft describes this capability as runFullTrust<\/code>, which allows a desktop application to operate outside the restricted Windows AppContainer.<\/p>\n\n\n\n

It is worth noting that this permission does not automatically give the app administrator or SYSTEM privileges, and there is no evidence that it steals files or other private information.<\/p>\n\n\n\n

However, a full-trust desktop application has more freedom than a sandboxed Store app, making installation without clear approval a valid cybersecurity and privacy concern.<\/p>\n\n\n\n

LG describes the installer as a tool for obtaining compatible monitor applications, including OnScreen Control, LG Switch and Dual Controller. The Store listing also contains McAfee trial language, confirming that antivirus promotion forms part of the application.<\/p>\n\n\n\n

Older LG Monitors Are Also Affected<\/strong><\/h3>\n\n\n\n

Owners cannot assume the behavior is limited to recently released hardware. Gamers Nexus received the same popup from an LG UltraFine 32UN880-B purchased three years earlier and already used in its office.<\/p>\n\n\n\n

https:\/\/www.youtube.com\/embed\/Q9uefFYe6bM?feature=oembed Watch as Gamers Nexus explains the issue<\/p>\n\n\n\n

Reports of LG Monitor App Installer appearing without approval date back to at least 2024<\/a>. More users have reported McAfee advertisements during recent weeks, which may indicate that LG has enabled the installer for additional models or changed how frequently the promotions appear. Android Authority described<\/a> the application as effectively functioning like adware.<\/p>\n\n\n\n

Windows Allows Device-Associated Apps to Install Automatically<\/strong><\/h3>\n\n\n\n

Microsoft also has a role because Windows permits manufacturers to associate Store applications with device metadata. The feature can deliver drivers and useful companion utilities when compatible hardware is detected, but it can also install promotional software without presenting the owner with a clear choice.<\/p>\n\n\n\n

Allowing a hardware vendor to initiate a full-trust application that immediately promotes a paid product exposes a weakness in this approval model. Windows treats the vendor association as sufficient authorization, even when the owner connected the monitor only to use it as a display.<\/p>\n\n\n\n

How to Remove This App<\/strong><\/h3>\n\n\n\n

Users can remove LG Monitor App Installer through Windows Settings and disable remaining LG entries under Startup Apps. Windows Pro and Enterprise users can also enable \u201cPrevent automatic download of applications associated with device metadata\u201d under Computer Configuration, Administrative Templates, System and Device Installation. Enabling this policy may also block useful companion applications for other hardware.<\/p>\n\n\n\n

LG had not publicly explained the behavior at the time of publication. Microsoft had also not announced any change requiring explicit approval before device-associated Store applications are installed.<\/p>\n","protected":false},"excerpt":{"rendered":"

This reminds me of the old Sony Rootkit that was installed from a music CD, showing just how little respect these megacorps have for you. My LG monitor is quite old, but Arch pacman doesn’t install things without me seeing and approving them… And yet another reason to ditch Microsoft products, though the GDID and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-18100","post","type-post","status-publish","format-standard","hentry","category-tech","category-world"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=18100"}],"version-history":[{"count":3,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18100\/revisions"}],"predecessor-version":[{"id":18104,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18100\/revisions\/18104"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=18100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=18100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=18100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}