LG monitors are silently installing adware through Windows Update, exploiting the same trusted channel meant to protect your PC

The Update Channel You're Trained to Trust Is Now Delivering Ads Through Your Monitor

Connect an LG monitor to a Windows PC and Windows Update installs an application on your machine with no prompt, no dialog, no consent screen. The application, called the LG Monitor App Installer, requests access to "All system resources" and your internet connection, then serves a recurring popup advertising a 30-day McAfee free trial 1. GamersNexus documented the behavior during monitor testing. Igor's Lab independently confirmed the mechanism after a user connected an LG UltraGear 27GP83B and two LG 27GN800 displays and traced the silent installation through Windows Reliability History 2.

LG did not hack Windows Update. It used the platform exactly as Microsoft designed it.

When you plug a peripheral into Windows, a component called the Device Metadata Retrieval Client compares the connected hardware against packages stored on Microsoft's servers and downloads matching drivers, icons, and supplementary software automatically. Microsoft describes this process as "Hardware-First Installation": the device connects, then the drivers and associated software follow 2. In its intended form, the mechanism is genuinely useful. Your monitor gets the right color profile, your printer finds its driver, your headset configures itself without a support-page scavenger hunt. The design assumes that whatever a certified hardware partner packages alongside their driver serves the user's interests. LG packaged McAfee advertising.

The LG Monitor App Installer is an officially published application in the Microsoft Store, serving as a central installer for LG monitor utilities like OnScreen Control, LG Switch, Dual Controller, and the UltraGear Control Center 2. It also registers itself as a startup application, relaunching on every boot, and serves popups advertising other LG-branded software alongside the recurring McAfee pitches 1. Forum complaints about the behavior date back to at least 2024 1.

The framing of this as an LG scandal misses the structural problem. Windows gives every hardware partner with a certified driver package the ability to push software through the same update pipeline that delivers critical security patches. Users have been trained for two decades to never question this channel. Security guidance across organizations generally boils down to: install every update, always. That guidance does not account for a manufacturer monetizing the delivery path.

For IT administrators, the implications are operational. The default-trust update channel that secures their endpoints is also the one pushing McAfee popups to desktops. Disabling the metadata retrieval mechanism is possible through Group Policy, specifically a setting Microsoft documents called "Prevent device metadata retrieval from the Internet" 2. But that fix is blunt: it also blocks legitimate device-specific firmware and driver metadata. Administrators are forced to choose between convenience and control over what lands on their machines.

For Microsoft, the issue is partner governance. The company certifies driver packages and distributes them through its own infrastructure, but the current architecture places no visible boundary on what partners can bundle inside those packages. LG's McAfee partnership turns a security-critical channel into an advertising surface, and the same door is open to any certified manufacturer with a Store listing and a revenue-sharing deal. Igor's Lab noted that users have reported similar silent installations with monitors from Dell and Alienware, though no systematic investigation of those cases exists yet 2.

For users, the trust model behind "always update" is what is cracking. The advice remains sound for security. But when the update channel also delivers adware that requests full system access, the confidence that makes the advice workable starts to erode. Igor's Lab identified three layers of trust intersecting in this scenario: the hardware manufacturer, the Microsoft Store, and Windows Update itself 2. When something goes wrong, the user has no straightforward way to determine which layer introduced the problem.

Users can stop the behavior locally. Windows Group Policy Editor offers a setting under Computer Configuration, Administrative Templates, System, Device Installation, to "Prevent automatic download of applications associated with metadata" 1. The LG app can be disabled from startup in Windows Settings, though direct removal through the Microsoft Store was not straightforward on affected systems 2.

LG's McAfee popups are the visible case. The systemic risk is that a peripheral installation channel designed to be frictionless and trusted has no mechanism to distinguish a critical firmware update from a subscription pitch. Any certified hardware partner with a Microsoft Store listing can use it the same way. The next one may not be advertising antivirus software.