LG monitors are using Windows 11 feature to serve adware

LG has come under fire over its Monitor App Installer, which is automatically and silently installed when plugging in some of the company's monitors. In this case, the monitor in question is a new LG UltraGear. Upon first connection to a Windows 11 device, the OS can check the associated device metadata and automatically install …

[KWD]

Let me fix that for you...

https://www.debian.org/distrib/

[just4this]

Re: Let me fix that for you...

Steve mentions in the video that it can be prevented via Group Policy, but that much messing about should not be necessary and is probably beyond the average user.

[Kurgan]

Re: Let me fix that for you...

And AFAIK group policies do not apply to windows home edition. Or am I wrong?

[just4this]

It can be enabled.

https://youtu.be/Q9uefFYe6bM?t=631 ←---- where Steve Mentions it.

I watched the vid a few days ago and didn’t rewatch before posting.

Win 11 home does not have Group Policy Edit out of the box but it can be enabled.

https://windowsforum.com/threads/how-to-enable-group-policy-editor-on-windows-11-home-step-by-step-guide-for-full-system-control.360840/

[Deckard_C]

Re: Let me fix that for you...

I believe the GPO is the same as running sysdm.cpl, Hardware Tab, button "Device Installation Settings", pick No

[JimmyPage]

Re: Group policy

But even the, MS have been know to merely treat GPO as advisory

[Stephen7Eastern]

Re: Let me fix that for you...

Show of hands, how many pros thought of altering that specific GP before plugging a monitor into a box? No one? Of course not. Anyway, this is why I have zero trust in MS and now even less than that for LG. It is also why I keep Auto Updates disabled on any Widows box along with the host firewall set to only allow a few whitelisted apps access to the internet (and use DNSCrypt to keep MS FW & hosts file bypass shenanigans in check). Turns out we really can't trust multi-nationals "to take your privacy seriously".

[drankinatty]

Re: Let me fix that for you...

Not sure it applies only to "multi-national", seems the old green-eyed-monster has destroyed business ethics and integrity. The ubiquity of technology just provides a hidden avenue to the frustration of all. At least early versions, like the Middle-East Sheik that needs your help with his bank account, was visible to all.

[ShipyardTechWork]

Re: Let me fix that for you...

Even if you can edit via GPO. You first have to know that GPO exists, then you have to configure the GPO correctly (something that's apparently harder to do than I'd think given the propensity of... Questionable GPO settings I've delt with). God forbid you're using one of the Windows versions where you can't edit GPOs - Believe it's the education version and the baseline Windows.

And that's assuming the GPO will actually apply correctly. Which is NEVER something that should be assumed.

[flayman]

Re: Let me fix that for you...

Why are we talking about Group Policy when the solution is to opt out of Recommended Settings? Who needs it? We're pros and can sort out our own shit, even if the the average user might find it useful in some cases.

[Anonymous Coward]

Re: Let me fix that for you...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching

Set (or create) the SearchOrderConfig key to 0.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore

Set (or create) the AutoDownload key to 2

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CloudContent

Set (or create) the DisableWindowsConsumerFeatures key to 1

Reboot

[Jou (Mxyzptlk)]

Total C-Suite fail

LG-OLEDs are fine. But abusing Windows Update to serve such things is level "malicious", and should be brought to court. A few hundred million €. It is an possible invasion of corporate premises, data theft (location etc) and so on.

And don't forget to point the finger at Microsoft too for their "WHQL tested and certified" rollout (or whatever the current abbreviation is).

[alain williams]

Re: Total C-Suite fail

Is this not a breach of the GDPR ? Not that our chocolate teapot of a regulator would do anything.

Computer misuse act would also be worth looking at.

[Yet Another Anonymous coward]

Re: Total C-Suite fail

But you agreed to it when you clicked OK on the 300 pages of Microsoft EULA.

You did have your lawyer review the EULA before you clicked OK didn't you ?

[Jou (Mxyzptlk)]

Re: Total C-Suite fail

Hold it, this is not USA here. Just 'cause it is written in EULA and you singed it, does not mean that whats written in the EULA is legal and therefore binding. Only in America the HumanCentIPad can be legal, if you agreed to it. Not anywhere else. There are a ton of illegal clauses nuked here, by our official customer protection agencies.

[bigphil9009]

Re: Total C-Suite fail

I love the idea of singing a EULA - at least it would provide some entertainment. :-)

[Bitbeisser]

Re: Total C-Suite fail

Singe wem Gesang gegeben, bei den meisten geht das voll daneben..

[Richard Pennington 1]

Singing the EULA

Back in the 1980s, I was a graduate student and a member of the university astronomy society.

Their constitution was set to music (Beethoven's "Ode to Joy" from his 9th Symphony, no less), specifically to prevent bad actors (or bad singers) from introducing malicious changes.

The constitution was ceremonially sung every year at the AGM.

[alain williams]

Re: Total C-Suite fail

The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.

This is point 6 of the right to be informed, hiding it in 300 pages is not "easily accessible".

[Yet Another Anonymous coward]

Re: Total C-Suite fail

>and it must use clear and plain language.

Elvish runes are perfectly clear language, while making them invisible is "cultural"

[Not Yb]

Re: Total C-Suite fail

To read the Elvish runes, you merely need to heat the EULA in a fire until they begin to glow. The paper burning before reaching that temperature is also cultural.

[Al fazed]

Re: Total C-Suite fail

Not only the C Suite, I have recenrly received a communication from my landlord, one of the larger social housing landlords, who have provided a slightly different interpretationb of

"concise, transparent, intelligible, easily accessible, and it must use clear and plain language"

Total Redaction of the names of officers involved as well as the content of the communication. The chronolgy of the documents had been shuffled like a pack of cards..............apparently this is part of the collation process and does not contravene the above.

in spite of https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/

It really seems like this place is being run by arrogant and ignorant twats who don;t give a f*ck because neither does the ICO, the SAR, local authority HB Team, Clerk to the Lord Mayor, Civil and Families division of the County Court, or the police.........

FFS.......Andy Burnham will not be capable of shifting this entrenched and abusive system of unelected government by people employed under the title "officer".

ALF

[Homo.Sapien.Floridanus]

Re: Total C-Suite fail

…. collect geo-location, device data, online activity, contacts, user credentials, transactions "and more."

Is this a typo or are they actually harvesting credentials? How is this possible?

[IGotOut]

Re: Total C-Suite fail

"How is this possible?"

Because it's Windows and they like spyware.

[FirstTangoInParis]

Re: Total C-Suite fail

McAfee is also one of the most painful products to work with and kills your performance stone dead.

Mind you, there’s also a lovely service on W11 called SysMain that attempts to load your apps into memory to speed up startup but flattens your performance while it’s doing that. Why can’t MS fix the damn problem instead of trying other smokescreen solutions that do not in fact improve the users experience?

[Not Yb]

Re: Total C-Suite fail

Once you've bought Windows, you're not the customer any more. MS has long considered web ads (and others) to be significantly more important than the person who isn't giving them any more money for the operating system. I'd not be too surprised if one of these days MS implements a "pay $1/month to run ad blocking software on device drivers" subscription. Annoyed, yes. Surprised, no.

[Twilight]

Re: Total C-Suite fail

I remember the days (LONG ago) when McAfee (and Norton) were actually great software...

[Doctor Syntax]

Re: Total C-Suite fail

Back then, of course, they were dealing with much, much less bloat.

[Elongated Muskrat]

Re: Total C-Suite fail

Not for nothing is it known as "McCrappy," just as Norton is known as "Notrun" because it makes your computer not run.

[Stephen7Eastern]

Re: Total C-Suite fail

Of course all "smart" TVs are not good for those who prefer privacy. For LG, see the below blog post from 2013 about their TVs spying on users.

https://doctorbeet.blogspot.com/2013/11/lg-smart-tvs-logging-usb-filenames-and.html

For the modern 2026 version of that blog post, watch the youtube video referenced in this article. It seems LG TVs TOS advises anyone near an LG TV, should be informed the TV is recording everything in the room and sending it back to LG. Seems LG-OLEDs might not be fine.

[Annihilator]

Re: Total C-Suite fail

There has been a subtle change in the way televisions are sold now. The majority of TVs are now ridiculously cheap, to the point they are sold at a loss now - the manufacturers have pivoted their revenue streams, knowing they can make more money serving adverts compared to the "once every seven years" purchase. They're also harvesting data, like you point out, but more in a "how you use the platforms, how you interact" that they can monetise and re-sell. Yes it's possible to opt out of all this stuff, but it's incredibly difficult to do.

[Eric 9001]

Re: Total C-Suite fail

There's no way TVs are being sold at a loss, but it is correct that panels are so cheap now, TVs can be sold for ridiculously cheap.

If TVs were sold for a loss, those who don't connect the TV to the internet and use video input only would sink the companies profits, which isn't happening.

Spyware is an additional revenue stream, which in total adds up to quite a bit, but on a per-unit basis, the profits are very low.

[Neil Barnes]

Re: Total C-Suite fail

Which is exactly what I'm trying to do as I am in need of a new TV (The ancient Toshiba, which merely flashes its power light at strange times of the day when it's turned off, is giving up the ghost).

The people in the TV shops seem incapable of understanding "I need a TV that does not complain when it does not have a network connection; I will be using it _only_ with an HDMI input" and just about every search result is answering the question "The TV is complaining about lack of network: how do I fix it?" which isn't exactly what I'm searching for.

I neither need not want 'smart' TV functionality, but will accept it if that's all there is - but it _must_ work without a network connection at any time (including setup). Any recommendations (available in Germany), please?

[Jou (Mxyzptlk)]

Re: Total C-Suite fail

Funny part, this is where LG has no issue. At least not my OLED C1 TV, which is >99.99% used as 4K 120Hz monitor. Neither LAN or WLAN connected.

The newer Models of C* and G* seem to behave the same. https://www.youtube.com/@hdtvtest if you are nerdy enough and https://www.rtings.com/tv .

[Eric 9001]

Re: Total C-Suite fail

You likely want a commercial TV - which are available from technology warehouses but not many TV shops.

Such should last quite a while for non-commerical usage due to a PSU and panel built to a reasonable lifespan.

You'll just need to make sure the model has a stand (or also get one) and if for some reason you want aerial TV reception without an external receiver, that it has an internal receiver of the correct proprietary specification.

Ironically, LG offers commercial TV's that work perfectly fine as a display without ever needing a network connection (there are merely some network functionality that unsurprisingly won't work).

But, you shouldn't purchase any LG TV without LG first advising in writing, that the complete corresponding source code and *installation information* of the GPLv2 & LGPLv2.1 software used will be available, as per the license terms, before you purchase the specific model.

(The sources available from; https://opensource.lge.com/ are *not* the complete corresponding source code and also lack the required installation information).

[Elongated Muskrat]

Re: Total C-Suite fail

"I will be using it _only_ with an HDMI input"

What you are after there is not a TV, it is a monitor, which is like a TV but doesn't contain the tuner, "on demand" apps, or any of the "smart" shite they bundle with it.

[Neil Barnes]

Re: Total C-Suite fail

Unfortunately, though, monitors in the size I've been told to look for cost significantly more than TVs.

[Elongated Muskrat]

Re: Total C-Suite fail

Last year's model is always almost the same as this year's model, but half the price.

[Jou (Mxyzptlk)]

Re: Total C-Suite fail

You totally miss the point that, in our case, a 77" monitor (my specific case) with 4k and 120 Hz literally does not exist. And my C1 from 2021, like most others, has a PC mode and a Game-console mode. Even my 65" Samsung from 2016 had it, though the follow up Samsung from 2021 I tried was such a massive failure I switched to above mentioned LG. Of course disable a few auto-brightness nonsense in the service menu is required.

I work at 100% zoom instead of 200% or more zoom, have more actual space instead of wasting it, being able to do pixel-edit in comfy 1.5 to 2 meters distance, using it as ebook-reader which allows sitting straight instead of head bowed down to the reader - important for your back. Except when I read from to couch :D.

[ITS Retired]

Re: Total C-Suite fail

If you do not connect your "Smart TV" to the Internet, it is clunky to use. Little things like the channel key pad doesn't work. You need the Channel Up/Down to change channels. Or you need to set up your Favorites so you at least can get close to the channel you think you want to watch, then fine tune with the channel up/down.

Why can't these so-called Smart TV's be uses the same as the old fashioned dumb tv's? Just make the channel key pad work.

[Jou (Mxyzptlk)]

Re: Total C-Suite fail

They can. Connect a satellite dish. Done. Linear TV, if you can remember, still exists. Terrestrial TV works too, but the picture quality is a mess compared to satellite as source. You can even connect a 4k blu ray player, no internet required... Or a little linux box which does everything the way you want.

[Annihilator]

Re: Total C-Suite fail

Some brands are selling at a loss, others are selling at margins that aren't sustainable:

https://tech.yahoo.com/general/articles/wondering-why-smart-tv-many-122329643.html

Premium models/brands are still profitable (OLED etc). But if you want to see how this is true, check out the lowest cost smart TV compared to the equivalent lowest PC monitor - they're about double the price (I know, some have better refresh rates, colours etc, I'm talking budget ones). 43" smart TVs are now in the ~£150 range, which is just ridiculous. 50" ones for low £200s. Yes, some people will remain entirely disconnected, but the majority will get suckered in to *some* measure of digital services.

[SundogUK]

Re: Total C-Suite fail

"Yes it's possible to opt out of all this stuff, but it's incredibly difficult to do."

Piece of piss for me. Don't watch TV, don't own a TV.

[Chz]

Re: Total C-Suite fail

LG's EU firmware is not quite as obnoxious, but you do have to be aware enough to not just tick the "approve everything" box and go about your life.

If you only allow the minimum, there are no ads, no spyware, etc. I've been told that you don't get to opt out of such things in other regions.

The main downside is that you do need an LG account to download any apps, should you want to, and that shares whatever details are in the account with them. If you're using a Fire TV or ATV+, you can skip even that.

[Anonymous Coward]

Re: Total C-Suite fail

And Samsung

[Craig100]

Re: Total C-Suite fail

How can a monitor manufacturer, or anyone actually, think that grabbing your contacts' details is ok? If I give you my contact details for YOU to contact me, I expect YOU to keep it to yourself. Here are massive corporations just hoovering up people's contact details for their own nefarious purposes. It should be flatly illegal IMHO.

[PCScreenOnly]

Logi Download Assistant

Also auto installs which is annoying as for me it serves no purpose.

the unifying software is useful once in a blue moon but that is a manual install

[Homo.Sapien.Floridanus]

Re: Logi Download Assistant

This feature is screaming out for supply chain attack.

[ecofeco]

Re: Logi Download Assistant

Logitec went to hell years ago. I'm using my last Logitec product and when it dies, I'm buying some no name brand from now on.

[Elongated Muskrat]

Re: Logi Download Assistant

Sadly, they own the manufacturing rights to the X-56 Rhino; I'd not buy anything else from them though.

[Reg Sim]

Its an advert all right...

Its an advert for every other AV/Malware software that reports it as Adware and elevated risk.

Its an advert for every OS other than Windows.

Its also an advert to Samsung if you still want your N.Korean LCD's.

It also makes me wring my hands. I bet it does not effect corporate windows versions.... because they disable the MS Store anyway.

-P

[snowpages]

Re: Its an advert all right...

N Korean???

[Yet Another Anonymous coward]

Re: Its an advert all right...

Well if your going to be all "North-is-up-on-maps" chauvinistic about it

[Anonymous Coward]

Re: Its an advert all right...

But Samsung isn't in N. Korea... Nor do they have any way of getting LCDs from there. NK is famously trade averse with the south, what with their two nation cold war still going on.

[Yet Another Anonymous coward]

Re: Its an advert all right...

Well Sony are in the Islamic Republic of Japan and they do OK

[FIA]

Windows would like to install HP Smarttools from the Microsoft store

... I mean I'd prefer it if you installed drivers that could by default print in colour on Windows 11... (like you can weirdly on Server 2025...)

[Al fazed]

FFS

I'd have been happy if the Windows 11 machine I just bought could print in good old black n white from my beautiful Canon pima which isn't ready for the grave yard by any means.

ALF

[Tron]

Other monitor manufacturers exist.

LG screens are OK but a sharp decline in their sales might send the right message out to any Cretin-suite suits who think this is a good idea.

[Dan 55]

Re: Other monitor manufacturers exist.

They've been up to these schanigens for over a decade so it must be working out somewhat okay for them, sadly.

[The Oncoming Scorn]

Re: Other monitor manufacturers exist.

schanigens?

I thought that was a rather nice beach near The Hague, Netherlands, where the ladies go..........

Ohhhh Scheveningen.

[C R Mudgeon]

Re: Other monitor manufacturers exist.

At this point the Sch(en)anigen Area has, alas, expanded to include pretty much all mass market tech.

[Dan 55]

Re: Other monitor manufacturers exist.

Curses, autoincorrect, you've beaten me again.

[Paul Herber]

Re: Other monitor manufacturers exist.

Oh for the good old days of Radio Veronica and Noordzee Internationaal.

[The Organ Grinder's Monkey]

Re: Other monitor manufacturers exist.

A home-cinema obsessed friend told me a long time ago that LG stands for "Low Grade."

[Elongated Muskrat]

Re: Other monitor manufacturers exist.

Other monitor sellers exist, but you might be surprised to learn that the second biggest* manufacturer of the panels they use is LG.

*after a Chinese company called BOE apparently

[Henry Wertz 1]

Microsoft forgets

Microsodt apparently forgot they used to have autorun in CDn and USB device insertion... but turned it off due to it's possibility for being abused. Although I doubt anyone expected a MONITOR of all things to abuse it.

I must add this makes me glad I swirched to Linux decades ago (1993). The only ads I've gotten from any of my distros, ever, are the mild things telling you how great the apps are on screens when the installer was running, and a ONE TIME notice that I could do backups with 'Ubuntu One' (which has been replaced with a general one time notice suggesting some kind of backups be set up since they discontinued their backup service.). And if even that is too much for one's sensibilities. well, there are even more 'libre' distros where they'd consider even that a step too far.

[Someone Else]

Re: Microsoft forgets

Microsodt [...]

Methinks your Freudian slip is showing...

[degraded RAID]

Re: Microsoft forgets

It's fine, just don't let Freudian slippers spread your legs.

[Kurgan]

Only drivers...

MS should enforce a clear policy that only drivers should be auto-installed.

And drivers must not exfiltrate data or show notifications. Everything else (bloatware) is optional and requires the user to install it.

But then MS is not here to help the user.

[steviebuk]

Have they forgotten about Sony's rootkit?

[M.V. Lipvig]

They were hoping you had forgotten.

[tiggity]

CMA (UK)

A long time since I looked at UK Computer Misuse Act 1990

Any of that activity fall within that law?

I hate unwanted / unrequested adverts* sufficiently to argue that automatic install of something that throws ads at you it falls under "Unauthorised Acts Impairing the Operation of a Computer" due to the ads (IMO) impairing computer operation.

* I hate ads but will sometimes grudgingly watch them e.g. preceding / during a YouTube video I want to see. But that's a situation where I know I will be served an ad (similar if I install an app manually and app tells me it will display ads for its funding, I can choose in that case to install (or not)

[Recluse]

Re: CMA (UK)

"I hate ads but will sometimes grudgingly watch them e.g. preceding / during a YouTube video I want to see"

If you wish to avoid You Tube adverts, I suggest you investigate self hosting your own Invidious instance via a docker container.

https://github.com/iv-org/invidious

[Yet Another Anonymous coward]

Re: CMA (UK)

Everything falls foul of the UK Computer Misuse Act , that's why it's so useful to prosecutors.

Sending an ethernet packet that collides? Accessing a web server that causes another page to be cleared from the cache? Press a key on a shared computer sending an interrupt?

[Paul Herber]

Re: CMA (UK)

What about jokes that cause:

coffee -> mouth -> keyboard?

[Yet Another Anonymous coward]

Re: CMA (UK)

Fine so long as I didn't use a computer to make the coffee

[AndrueC]

Re: CMA (UK)

* I hate ads but will sometimes grudgingly watch them e.g. preceding / during a YouTube video I want to see.

I use an adblocker. I sometimes have to wait 20 seconds looking at a black screen before the video loads but I never see any adverts.

[Anonymous Coward]

Re: CMA (UK)

" I hate ads but will sometimes grudgingly watch them e.g. preceding / during a YouTube video I want to see"

Unfortunately there is no way to block ads when using the YouTube app on Android.

But I discovered an app on GitHub called AdSkipper that automatically presses the "skip" button on ads in YouTube using accessibility functions.

I wouldn't watch YouTube videos without it as there are ads every 4 minutes sometimes.

[Yet Another Anonymous coward]

Re: CMA (UK)

>Unfortunately there is no way to block ads when using the YouTube app on Android.

Brave browser

There is a certain level of crypto-adjacent techbro manual-self-pleasurers behind it, but it's one of the best ways of not seeing ads on all platforms

[Uncle Slacky]

Re: CMA (UK)

PipePipe seems to block YouTube ads pretty well:

https://f-droid.org/packages/InfinityLoop1309.NewPipeEnhanced/

Ublock Origin does the trick on Firefox, at least on the desktop.

[captain veg]

they can't help themselves

LG clearly now considers itself primarily an advertising platform, but one which the punters pay for themselves.

https://lgads.tv/smart-tv-advertising/

Trebles all round!

-A.

[Jerome]

This is an incredibly stupid Windows policy.

Why not ask the user if they want to install the companion app?

[tfewster]

Re: This is an incredibly stupid Windows policy.

Throw in some dark patterns and selective BS if you have to: "Don't not install this app to get the best out of your monitor".

[Yet Another Anonymous coward]

Re: This is an incredibly stupid Windows policy.

"Click here to not share your data with 3rd parties (*)"

* You will only see ads sold by our wholly owned subsidiary ad-delivery business

[MazeFrame]

LG lost all credibility when their 3000 money units televisions had spying-by-default for their built in microphone, motion detector and content scanning.

Double dipping on advertisers and consumers is just shameful.

[Paratiritis]

Just like Recall from everyone

We do not only have to worry about Windows Recall becoming standard, we now also have to worry about any keyboard, mouse, monitor or other equipment manufacturers potentially getting full access to our machines and receiving data on and how we are using them.

[Al fazed]

Deja Vu or what ?

McAfee has been silently installing itsaelf on Microshaft products sine at leadt Windows 3.11.

I always assumed it was an outreach from the CIA, somehow hoping you hadn't noticed it's app consuming all of your megre RAM.

AHEM

Coat, black helicopter..........

ALF

[Doctor Syntax]

Reasons not to use Windows ...

... no 837.

But I may have miscounted.

[herman]

Re: Reasons not to use Windows ...

The correct number of reasons is 666

[Paul Herber]

Re: Reasons not to use Windows ...

Though actually may be as low as 616.

[KittenHuffer]

Re: Reasons not to use Windows ...

I thought the reason was 365

[xyz123]

Not just Adware...malware that downloads further payloads, designed to access webcams/microphones etc.

PLUS stuff that will keylog everything you do and send it to LG, plus take copies of items in My Documents to upload to LG.

Had to abandon this brand entirely. Cannot use LG screens due to secure work environment. Currently there are discussions on disposing of over 6000 screens & possible lawsuits against LG.

Although you CAN block this behaviour, my work isn't prepared to take the risk of a new machine compromising the entire network, opening us up to trade secret theft, ransomware attacks from LG subsidiaries etc.

[Anonymous Coward]

Oh, I really do hope your work sues the hell out of LG! Luck Good, I mean Good Luck!

(That’s a massive zero goldstars for LG, of course!)

[Neil Barnes]

Ah, but all their gold stars are lucky!

[anonymous boring coward]

"Although you CAN block this behaviour"

But why would you give money to LG?

Buy something else.

[Throatwarbler Mangrove]

Group policy

Open "Edit Group Policy" (gpedit.msc)

Expand Computer Configuration

Expand Administrative Templates

Expand System

Click Device Installation

Double click "Prevent automatic download of applications associated with device metadata" in the panel on the right.

Click Enable

Click Apply

Click OK

I have an older LG monitor, and was unpleasantly surprised to find new software being installed. In addition to the steps above, I removed the LG Monitor Installer application as well.

[cookieMonster]

Re: Group policy

All this just to use a monitor, and I can’t fucking believe I’m about to write the next bit, securely, on windows. FTActualF.

[AKA_anonymous_coward]

Hardware installing programs

I read a fascinating attempt to stop a driver from a Chinese server from being installed on a Windows machine on the Malwarebytes forums.

They had created scripts to dig through the Windows registry to search for strings about the driver and ran multiple antivirus programs but the driver still was being downloaded.

It's important to note that while the driver in question was not malicious in itself, it was on the list of vulnerable drivers that were used to elevate privileges or run kernel level malware in the BYOVD (bring your own vulnerable driver list.

They had even reformatted and cleaned the hardrive and reinstalled Windows yet the vulnerable driver was still getting downloaded after restart.

As it turned out, the driver was getting installed by the users desktop computer case in a similar fashion as the LG monitor.

[Anonymous Coward]

Re: Hardware installing programs

The *CASE*?! Did the case have a display, an RGB controller, or something like that?

[Tom Chiverton 1]

Re: Hardware installing programs

Standard "anti theft" or motherboard device driver install tatic theae days is to shim in the install from UEFI before Windows even boots.

[David 132]

Re: Hardware installing programs

We trust that the USB header cable on the case does, in fact, merely route to a passive set of ports on the front/top/side of the case. As such cables have done since, ooh, 1999 or so.

But what a wonderful thing it would be, for those of an MBA-type mindset, if it also included a storage-class device to install "carefully curated" "promotional" software "from us and trusted partners" when plugged in, eh?

[StewartWhite]

Gen Pop simply doesn't care

The article states that 'However, we doubt many users would choose to install it from there, considering the Store listing says the app can access "all system resources" and the user's internet connection.'

I think you're overestimating the intelligence of most users as a) they don't read listings beyond "This is the new shiny" and b) they don't care or understand about the implications of it having access to all system resources and their internet connection.

[ecofeco]

Re: Gen Pop simply doesn't care

Care? They don't even know.

How can they?

[ChoHag]

Re: Gen Pop simply doesn't care

We could tell them, but we're afraid of the "this is how much they want to fuck you" language.

[Doctor Syntax]

Re: Gen Pop simply doesn't care

I think you're overestimating the intelligence knowledge of most users

This is the basic problem of all IT security.

[frankyunderwood123]

Windows is malware

If you are unfortunately forced to use windows or have to use it for a specific purpose then the suggestion is you install some anti-malware software for windows, otherwise known as a debloater.

There's a few well eyeballed open source repos that you can find if you search about.

Malware:

"Malware, short for "malicious software," is any program or code specifically designed to disrupt, damage, or gain unauthorized access to a computer system."

Windows falls under Spyware and Adware, which makes it Malware.

Another suggested fix is to use a different operating system that may be able to run the software you need for that specific purpose.

It could be an obscure app or even a popular one that only runs under windows.

It could be a game.

This fix is gaining traction - rapidly approaching well into the 90% of windows apps/games running flawlessly on other operating systems.

(e.g. Linux or macOs)

Sadly if your company issues you with a windows based computer there is no solution to the malware problem - just be thankful you have a job OR ...

Try and trick your friendly sysadmin into allowing you to install virtualization software...

[StinkyMcStinkFace]

LG has REPEATEDLY shown contempt if not outright hatred of it's customers. So be it. We will spend our money elsewhere.

I have zero interest in "working around" their attempts to annoy me. I will never buy another LG product. Problem solved.

[Anonymous Coward]

Attention Skankware Pushers!

Microsoft: "Hey, skankware pushers, you can use our API to automatically install your shit onto Win11 boxes! Some users may become frustrated or confused by this. LOL." *wink-wink, nudge-nudge*

[blu3b3rry]

I vaguely remember LG products having a reputation for being crap

Admittedly that was around twenty years ago but can't say I've ever bought an LG product. That won't be changing, f$ck em.

That said I discovered the HP Z-series monitor mounted to the side of my workbench does a similar trick to any Windows machine you connected to it. Bastards.

[anonymous boring coward]

Re: I vaguely remember LG products having a reputation for being crap

Someone still buys HP? Why?

[blu3b3rry]

Re: I vaguely remember LG products having a reputation for being crap

For some reason my employer still buys HP kit, although given the price / quality difference its a bit of a mystery as to why!

[Luiz Abdala]

Autoplay all over again...

Autoplay could deliver all sorts of nasty payloads, including but not limited to Sony's rootkit DRM...

...this one doesn't even need storage or a USB port which is brilliantly stupid in the worst way possible.

People forget lessons learned every... 10 years?

[Antony Shepherd]

Unlucky Goldstar, more like

What fresh hell is this? A monitor should do no more than display the image being sent to it.

I do not want a monitor which has an app, FFS!

[Anonymous Coward]

Headphones apps

This story is now making me even more suspicious about all these cheap Chinese Bluetooth headphones which all heartily encourage you to download their whizzbang EQ app on your mobile phone “for the best experience”.

I’d always had a feeling that there was more to those apps than met the eye (and, no, of course, I never installed them). Data exfiltration much?

[Doctor Syntax]

Re: Headphones apps

“for the best experience”

A phrase which translates to "on no account should you even consider buying this".

[just4this]

Old joke update.

In Windows monitor monitor you!

[Chris Comley]

Oh hells no.

<moves LG to the very bottom of the list for ANY device purchase>

If the software is malicious, and if the hardware doesn't' work without the software, it's going RIGHT back. This sh1t needs nipping in the bud. Possibly at ground level.

[Anonymous Coward]

And one rung above on the list are HP printers.

[NiteDragon]

This all works by device EDID doesn't it?

Could potentially build a connect through device to sub out bytes 8-11 for something generic... wonder if that would "fix it" along with any other future manufacturer that thinks this is a "great idea".

[Haynomonous]

And so the grand enshittification continues.

[Roland6]

LG Update: “ Under no circumstances is McAfee installed automatically or without user authorization”

> "The LG Monitor App Installer is distributed through Microsoft’s official Windows distribution process, which included McAfee as an option. McAfee will be installed only if a user actively chooses to proceed with the installation and provides consent. Under no circumstances is McAfee installed automatically or without user authorization."

I expect LG are being economical with the truth here.

From experience with other “free” software (eg. The update installer for CCleaner.) the option to installl the third-party package is selected by default, so it is very easy to simply click okay, okay and find you have also installed a bundle of other stuff…