The complete install chain of the LG Monitor App, recovered from one of our own Windows machines: two LG packages signed as drivers, carrying no driver code, delivered by Windows Update, installing LG's app under SYSTEM with no consent — and still maintained months after the monitor left. This is the evidence behind the main alert.
Nothing in this report has changed, and that is the point. LG agreed to disable the McAfee pop-up; by July 24 the McAfee references were off the Store listing. Every finding below sits in the layer underneath that pop-up — the delivery, the missing consent, the persistence. Both LG packages are still resident on this machine, still wired to 51 hardware IDs.
What is new is a promise, not a change. An LG support notice dated August 3, 2026 says LG “is updating the Installer so customers can decide whether they would like to install it” — the first acknowledgement of the consent gap this report documents. It carries no date, version or mechanism, and says nothing about the two driver-store packages below. The app's Store product was updated on August 12; no changelog is published, and we have not re-run a first-connection test, so we cannot tell you whether the behaviour recorded here still reproduces. This machine has not been cleaned or reconnected — it is held as it was. What the notice says, in full.
One limit, stated plainly: LG told press the installer “does not access, collect, or transmit any customer personal data.” This report makes no claim either way. We captured no network traffic, and nothing here is evidence of exfiltration. What is documented is how the software arrived, that no consent surface existed, and that Windows maintained it for nine months after the monitor was gone. Claim-by-claim comparison in the full report.
LGElectronics.LGMonitorApp from the Microsoft Store under SYSTEM, about 32 seconds after delivery. No prompt, no EULA, no entry in the classic programs list.Reconstructed from Windows Update, CBS/servicing, Store install-service and Reliability Monitor logs. A small clock offset between sources was measured and accounted for; the ordering is unaffected.
LGElectronics.LGMonitorApp from the Microsoft Store. SYSTEM installs it.Both from provider LG Electronics Inc., dated August 27, 2024, WHQL-signed and co-signed by Microsoft. In the driver store:
lgmonitorappextension.inf — class Extension. No driver code. Fabricates a phantom child device so a companion package has a binding target.lgmonitorappsoftwarecomponent.inf — class SoftwareComponent. No driver code. Carries the single directive that delivers the app.The delivery directive lives in the SoftwareComponent INF: an AddComponent entry with SoftwareType = 2 — the INF form that tells Windows to install a named Microsoft Store app for a device. Target: LGElectronics.LGMonitorApp. That is the entire mechanism. A “driver” whose only job is to make Windows install an app.
The full INF text and the complete signing chain are preserved in the evidence set.
We looked specifically for the points where a user could have seen or approved this:
The panel was unplugged in mid-October 2025. The app was not. Version chain on this machine:
1.2606.1601.0, staged by SYSTEM. Nine months after the monitor left.Uninstalling the app alone does not end this. Both LG packages stay in the driver store, and reconnecting any listed LG panel re-arms the chain. Full removal is in the fix.
The resident LG extension package wires 51 hardware IDs across 19 monitor models for automatic app delivery. The models:
Each model maps to one or more hardware IDs (monitor plus hub/companion enumerations), 51 in total; the complete table is preserved in the evidence set. Note what is absent: the models driving the news cycle — UltraGear 34GX900A-B, 27GP83B, 27GN800, UltraFine 32UN880-B — do not appear in this revision. LG ships multiple revisions with different coverage, so the real footprint is larger than any single list, ours included.
Alienware was named alongside LG in early coverage, so the distinction matters. Dell told TechSpot that current Alienware Command Center versions require the user to approve installation and show no third-party advertising, with an opt-in prompt added in AWCC 6.6, February 2025. Dell's documentation confirms Windows can still begin that install after detecting supported hardware — same road, consent step added. We have not tested Alienware hardware ourselves; we report Dell's statement as a statement.
Get-AppxPackage -AllUsers LGElectronics.LGMonitorApp | Remove-AppxPackage -AllUserspnputil /enum-driverslgmonitorappextension.inf and lgmonitorappsoftwarecomponent.inf. Read each published name off the list (oemXX.inf; the numbers differ on every machine), then run once per package:
pnputil /delete-driver oemXX.inf /uninstallSurgical: it removes only LG's app-delivery packages. Other devices keep their drivers and companion software, and real driver updates keep flowing. Windows Update can re-offer LG's packages if a listed LG panel is connected again.
On Windows Home, where there is no Group Policy Editor, the device-metadata hardening step and its caveats are on the main page: the fix, including the registry method.
This machine was not cleaned; it is held as evidence. If you can reproduce or refute any step, we want to see it. What we're collecting — and the PowerShell to read your app version — is on the main page.
← Back to the alert