LG Monitors Install McAfee Software via Windows Update Without Consent

LG Monitors Install McAfee Software via Windows Update Without Consent

TL;DR – LG monitors silently push a McAfee trial app via Windows Update, bypassing any user prompt, and the same mechanism can affect older models.

What actually happens?

When an LG monitor (e.g., UltraGear 34GX900A‑B) is connected to a Windows PC, Windows Update silently downloads two packages labeled LG extension and LG Monitor App Installer. Within a minute the installer runs, showing a McAfee‑branded popup that offers a 30‑day trial which converts to a paid subscription if not cancelled. No consent dialog appears, and the installation proceeds automatically.

"Windows Update first installed LG extension and software component packages. Windows Reliability Monitor showed that LG Monitor App Installer appeared one minute later. The installation did not display a consent prompt or require the user to approve the download." – Gamers Nexus investigation.

How widespread is the issue?

  • The behavior is not limited to brand‑new displays. Gamers Nexus observed the same popup on a three‑year‑old LG UltraFine 32UN880‑B.
  • User reports on forums date back to at least 2024, indicating a long‑running practice that has recently resurfaced on more models.
  • The Microsoft Store entry for the app lists permissions for full internet access and unrestricted system resource usage, raising privacy concerns.

Technical mechanism – Windows’ device‑metadata driver delivery

Windows can associate a hardware device’s metadata (e.g., a monitor’s EDID) with a downloadable application. When the OS detects a matching device, it automatically pulls the linked package from Windows Update. This feature is intended for legitimate driver updates but can be abused to push unwanted software.

Relevant Group Policy setting (Windows 10/11):

Computer Configuration → Administrative Templates → System → Device Installation →
    Prevent automatic download of applications associated with device metadata

Setting this policy to Enabled stops Windows from auto‑installing any app tied to device metadata, including the LG/McAfee bundle. Home editions without gpedit.msc can adjust the same option via System Properties → Hardware → Device Installation Settings and selecting No for “Do you want to automatically download manufacturers’ apps for your devices?”.

Comparison with other manufacturers

Dell employs the identical Windows Update pathway to install the Alienware Command Center when an Alienware monitor is detected. The same Group Policy toggle blocks Dell’s installer as well, demonstrating that LG is not unique in leveraging this mechanism.

"We had to use the same Windows Group Policy setting to block device‑associated application downloads." – Gamers Nexus.

Community reaction on Hacker News

  • Security concerns – Commenters labeled the behavior malware or spyware because it installs software with internet access without user interaction.
  • Policy blame – Some users argue the fault lies with Microsoft’s permissive driver delivery system, not LG itself.
  • Workarounds – Multiple commenters posted step‑by‑step instructions for disabling the automatic download feature via Group Policy or the System Properties dialog.
  • Broader frustration – Several participants expressed distrust of hardware vendors that bundle adware, noting similar practices in TVs, motherboards, and other peripherals.

Why does this matter?

  1. User autonomy – Automatic installation removes the user’s ability to decide what software runs on their machine.
  2. Privacy risk – The McAfee app requests unrestricted network access, potentially exposing browsing data to a third‑party vendor.
  3. Precedent for other hardware – If LG can push adware through Windows Update, other manufacturers can adopt the same approach, expanding the attack surface.
  4. Corporate accountability – The issue highlights a gap in Microsoft’s driver‑delivery policy; pressure on Microsoft could lead to stricter enforcement or a revocation of update privileges for offending vendors.

Mitigation checklist for affected users

  1. Disable automatic device‑metadata downloads using the Group Policy or System Properties method described above.
  2. Uninstall the LG Monitor App Installer via Microsoft Store → Library if it has already been installed.
  3. Monitor Windows Update history for entries labeled LG extension or similar and block them manually.
  4. Consider alternative OSes or a clean Windows installation with a hardened configuration if you require strict control over installed software.
  5. Report the behavior to Microsoft’s Windows Insider feedback hub and to LG’s support channels to increase visibility.

Bottom line

LG’s use of Windows Update to push a McAfee trial app without consent is a concrete example of how hardware manufacturers can exploit Windows’ driver‑delivery infrastructure to install unwanted software. Users can block the behavior with a simple policy change, but the incident underscores the need for tighter oversight of automatic driver and app distribution mechanisms.

Sources