The alert is a timeline; this is the reporting under it. What LG says against what our machine shows, the August 3 notice where LG finally addressed the automatic install, when the advertising switched on, LG's record, the complete fix with its caveats, and every source we used.
The whole chain came off one of our own machines, timestamped. The short version is on the alert; the minute-by-minute evidence, including LG's own INF directives, is in the forensic report.
The app's first visible act is a McAfee pop-up — a “30-day trial” / “Scam Detector” offer. Take it and, as Windows Latest documented, the trial rolls into McAfee Plus Premium at $39.99 for the first year, in smaller text. That is the business model your monitor quietly plugged you into.
Uninstalling the app alone leaves the machine armed. Both LG packages stay in the Windows driver store, wired to 51 hardware IDs across 19 models. Connect any of them and the chain fires again. Both layers are in the fix.
And we're not alone: Windows Latest documented an LG 34GX900A-B owner who got the pop-up on a random login with no cable between monitor and PC at all. Once the software is on the machine, the panel stops mattering.
Microsoft documents three preconditions for this delivery. All three are the default path through a consumer install, not choices anyone makes deliberately — which is why the install base was built without anyone noticing:
Declining Recommended Settings is a real reason you may have been spared. The 30-second check is on the alert.
On Microsoft's role. Both LG packages here are signed “Microsoft Windows Hardware Compatibility Publisher” — Microsoft co-signed the distribution — on a machine at stock defaults. Its own developer documentation concedes the result: “the automatic installation feature does not provide a notification to the user when the app is installed.”
On July 22, LG emailed a statement to outlets that had asked for comment — Windows Latest, The Register, TechRadar and PCGamesN all report receiving it. No press release. It rewards close reading: precise about a charge nobody made, silent on the one that matters. LG's paragraph runs in full across these three rows, strongest denial included, so you can judge it yourself.
“LG Electronics reiterates that McAfee is not installed automatically and is never installed without the user's explicit consent… McAfee will be installed only if a user actively chooses to proceed with the installation and provides consent. Under no circumstances is McAfee installed automatically or without user authorization.”
Agreed — and nobody said otherwise. McAfee was never what installed silently. LG's own app was. McAfee is what that app then put on screen, on 31 of 32 consecutive boots. Every sentence here is about McAfee. Not one is about the app that arrived uninvited to show it.
“The LG Monitor App Installer is distributed through Microsoft's official Windows distribution process, which included McAfee as an option.”
Correct — and that is the finding. Windows Update delivers two WHQL-signed LG packages, Microsoft co-signs them, SYSTEM installs the app 32 seconds later. “Official” describes the road. It does not describe consent.
The Monitor App Installer “does not access, collect, or transmit any customer personal data.”
We have no evidence of exfiltration and have never claimed any — our findings are about consent and persistence. But it sits against the permissions the app is listed as holding, and it is the one claim a packet capture settles outright. Send one.
Updated Aug 16 — this is no longer entirely true. Through July we wrote that nobody, at either company, had said the app would stop installing itself: Gizmodo asked LG and published without a reply, The Register put the equivalent question to Microsoft and had none by publication. On August 3, LG said it — in a support notice, in the future tense. We take it apart below. Microsoft still hasn't, and the mechanism underneath is exactly as it was on July 17 — not LG-specific, but a Windows feature any vendor can use.
And it was never only McAfee. Gizmodo reports the app also served pop-ups for LG's own streaming service. Switching off one advertiser is not switching off advertising.
For contrast: Dell told TechSpot that current Alienware Command Center versions require the user to approve installation and carry no third-party ads, with an opt-in prompt added in AWCC 6.6, February 2025. Windows can still start that install after detecting the hardware. Same road, consent step bolted on — and TechSpot revised its headline to draw the line. That difference is the whole story.
Twelve days after the July 22 climbdown, LG published a statement of its own — not to press, but as a support notice on its South Africa site, dated August 3, 2026. It is the only place we have found LG address the thing this site is about. Two sentences matter:
“Following customer feedback, LG removed the recommendation and does not plan to recommend McAfee or other third-party software through the Installer in future.”
“As part of its commitment to continuously improving the customer experience, LG is updating the Installer so customers can decide whether they would like to install it. This update provides greater visibility, control and choice.”
LG, “LG Monitor App Installer,” August 3, 2026
Read the second one carefully. “It” is the Installer — the app that arrives on its own. That is LG conceding the consent gap, and it is more than the July agreement covered. It is also the weakest possible form of the concession: no ship date, no version number, no description of what the choice looks like, and no commitment about the two driver-store packages that do the delivering.
.inf packages, or about machines already carrying the app.One sentence in it doesn't survive our own logs. The notice says applications “are only installed if the customer chooses to proceed.” That is true of the apps the Installer offers you — OnScreen Control, LG Switch and the rest. It is not true of the Installer, which is itself an app, and which arrived on our machine under SYSTEM 32 seconds after Windows Update delivered LG's packages, with nothing to proceed through. The notice describes the room and skips the door.
How we sourced it, and its limits. We read the notice on LG's own domain and confirmed its date in the page's structured data (datePublished: 2026-08-03), because the visible stamp — 08/03/2026 — is ambiguous by region. The same URL path returns 404 on LG's US, UK, Australian, Indian, Singaporean and Canadian sites; we did not find it on a newsroom or in any coverage. We are not calling that deliberate — regional support CMSes are messy — but a commitment published in one region and announced nowhere is not a commitment the people affected can find.
Microsoft, meanwhile, has said nothing further. In February it announced that Windows would start prompting users “when apps… attempt to install other unintended software,” rolling out in phases with no dates attached. That framework is aimed at what an app does once it is running. It does not describe the channel that put this one on the machine — hardware detected, metadata matched, Store app installed by SYSTEM — which is documented, supported, and still open to any vendor who registers for it.
Then, on August 12, the Store product for the app was updated. Microsoft's own listing data gives a last-update stamp of 2026-08-12 for LGElectronics.LGMonitorApp. We cannot tell you what is in it: the listing publishes no changelog now, and we have not put an affected panel on a clean machine since. What the listing does still say, checked on August 16, is that the app “uses all system resources” and accesses your internet connection — unchanged — and that its rating is 1.0 stars across 421 ratings. If you have a monitor and a spare machine, that first-connection test is the single most useful thing anyone can send us right now.
The install base was built long before the ads were. The complaint thread on Microsoft's own Tech Community opens November 18, 2024, and for twenty months every post is about the mystery install — a repair tech in July 2025 calling it a force-installed PUP on client machines; a March 2026 user watching it land with the device-metadata and Store-disable policies both enabled. Not one post mentions advertising. The reply marked as the official solution said the app was safe.
Then July 1, 2026: the first McAfee Scam Detector pop-up. Every reply since is about ads.
That date fits the app's own version chain here:
The numbering reads as year-month. A June 2026 build rolling out through staggered Store updates lands exactly where the thread turns into ad complaints, Reddit lights up, and Gamers Nexus's three-year-old UltraFine starts popping mid-production.
LG's own paperwork agrees. On July 21, Windows Latest found the Store listing carrying a changelog entry — “Additional App / – McAfee”, added in a recent update, with 30-day-trial copy. A changelog entry ships inside a build; it is not a server-side flip. Note what it does not establish: that wording describes a directed install the user has to act on, consistent with LG's consent claim rather than a contradiction of it. We cite it for the timing, not as a gotcha. Those references are now gone from the listing.
Still unproven: whether the advertising is only in the build, or can also be switched on remotely. The app is internet-connected and its payload can change. Reader data settles it.
Reading the app's Microsoft Store listing and LG's terms on air, Gamers Nexus found the auto-installed monitor app “technically” holds permission to use all system resources, plus:
Re-checked August 16, 2026. The Store listing still declares exactly two permissions — “uses all system resources” and “access your internet connection” — after the August 12 product update. The app ships with runFullTrust. Nothing here narrowed.
It's a monitor. It should not want your logins, location, contacts or transactions. GN has since put lawyers on roughly 40,000 words of LG agreements; that work is still running.
“Spyware” isn't hyperbole with LG. It's a pattern. The monitor is just the newest vector.
The Texas case is settled, and that cuts both ways. Paxton sued five TV makers in December 2025; on May 11, 2026 LG's US unit settled — with no admission of liability, per the Korea Herald — agreeing to obtain consent before collecting viewing data, to show a pop-up disclosure, to post the same on its website, to offer a clear opt-out, and to bar transfers of viewing data to the Chinese Communist Party. LG says it “places a high priority on protecting consumer privacy” and worked with Texas to strengthen its existing consent practice. Cases against Sony, Hisense and TCL continue; Samsung settled earlier. So the allegations above were never tested in court — and the remedy Texas extracted was, precisely, ask first. Two months later a monitor did the opposite.
LG's answer, in its own words. The same July 22 statement carried a second paragraph, published in full by TechRadar: LG “reaffirms that LG TVs do not collect, record, or store ambient conversations,” calls voice recognition optional and user-initiated, and says Smart TV features work without it. We run it because this section makes serious allegations. Note what it denies — ambient audio — against what Texas actually alleges: periodic screenshots of what's on screen.
Two layers. Remove the app, then remove LG's delivery packages — or the machine re-arms the next time a listed LG panel is plugged in.
Get-AppxPackage -AllUsers LGElectronics.LGMonitorApp | Remove-AppxPackage -AllUserspnputil /enum-driverslgmonitorappextension.inf and lgmonitorappsoftwarecomponent.inf. Read each one's published name off the list (oemXX.inf; the numbers differ on every machine), then run once per package:
pnputil /delete-driver oemXX.inf /uninstallSurgical. It deletes LG's app-delivery packages and nothing else. Printers keep their scanning software, mice and keyboards keep theirs, real driver updates keep flowing. Windows Update can re-offer LG's packages if a listed panel is reconnected — we're watching our own machines for that, and anything that changes gets reported here first.
Does the McAfee news change any of this? No. Killing the pop-up removes the symptom that made people look. It doesn't uninstall the app, doesn't remove either package, doesn't close the consent gap.
We promised this, so here it is — caveats first, because we read Microsoft's documentation instead of the summaries of it. This is the registry value behind the Group Policy “Prevent automatic download of applications associated with device metadata” (older ADMX files name the same setting, same path, “Prevent device metadata retrieval from the Internet” — search both). Elevated prompt, then reboot:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" /v PreventDeviceMetadataFromNetwork /t REG_DWORD /d 1 /fReverse it with reg delete on the same value. UI equivalent, any edition, no registry editing: Settings → System → About → Advanced system settings → Hardware → Device Installation Settings → No.
So why publish it? Because we promised it, because it is real hardening against the device-metadata path, and because you deserve the caveats more than the confidence. We have not reproduced a blocked install with it. When we do, the result gets published whichever way it goes. Package removal remains the primary fix — the only step we've verified.
On Pro/Enterprise: same setting at gpedit.msc → Computer Configuration → Administrative Templates → System → Device Installation; community testing says it stops these installs on many machines. Same caveats, same conflicting field report. The one policy that gates the driver channel outright also kills real driver updates, so we don't recommend it on home machines.
On Microsoft's role. Both LG packages here are signed “Microsoft Windows Hardware Compatibility Publisher” — Microsoft co-signed the distribution — on a machine at stock defaults. All three of Microsoft's documented preconditions are the default path through a consumer install, not choices anyone makes deliberately. Its own developer documentation concedes the result: “the automatic installation feature does not provide a notification to the user when the app is installed.”
Checked, not published. Several outlets and AI search summaries date LG stripping McAfee content from the app to July 13, 2026. We fetched the pages: no outlet reports it firsthand, and pop-ups were still being reported after. One summary even named Windows Latest as corroboration, which that outlet does not provide. Noted so readers who meet the claim know why it's absent — and as a caution about trusting summaries over the pages they summarize.
On the August update. LG's notice was read on lg.com, not in coverage of it — there is none we could find. Because 08/03/2026 reads differently by region, we took the date from the page's own structured data (datePublished: 2026-08-03T03:00:00Z) rather than the printed stamp, and checked six other LG regional sites for the same page. The August 12 product date, the permissions, the package family name and the 1.0/421 rating come from Microsoft's own Store listing data for 9PM9N6F47JB8, read on Aug 16 — a listing, not a machine. We have not tested a first connection since the update; we say so rather than implying we did.
Every quote, date and URL here was re-verified against the primary page, not a search summary. Firsthand findings are labeled as ours and documented in the forensic report.
Dates, numbers and the two-step removal are on the alert — built to be read in a minute rather than an hour.
← Back to the alert The forensic report Send a tipWhy a PC shop is publishing this: we build and support computers for a living — 10-year warranty, lifetime support. When hardware starts installing adware on our customers' machines without asking, it lands on our bench. So we tested it and published the whole chain. This page is reporting, not a pitch: there's nothing to buy here. More about CEC ↗