AndWhatStudio.com

If you’ve used the G-Archiver program to back up your Gmail (aka Google Mail) email, you’ve got a headache on your hands. The program has been revealed to be a malicious spyware app that emails your Gmail username and password to a secret Gmail account.

This revelation is especially troubling because most Gmail users use a single Google account to access a wide range of services. Those with AdSense accounts or Google Checkout accounts could face severe financial losses if their Gmail password were to fall into the wrong hands.

G-Archiver is wholly unaffiliated with Google or Gmail and is the product of an independent developer. The revelation that G-Archiver was spyware emerged last week courtesy of programmer Dustin Brooks, who analyzed the source code to find a crude spyware system inside, complete with the name and password of the account to which G-Archiver sends all its victims’ account information. He accessed that account and found thousands of records of usernames and passwords inside, including, of course, his own. (Brooks also deleted all those records and changed the password on the account by way of vigilante justice. Good man!)

Meanwhile, in what has to be the least credible excuse/explanation ever, G-Archiver has posted a notice on its website that the program was not spyware but rather that “a member of our development team had inserted coding used for testing G-Archiver in the debug version and forgot to delete it in the final release version.” Uh, right…

G-Archiver’s solution, however, is correct: If you have ever installed the program you should uninstall it and change your Google account password immediately. G-Archiver is so new that it probably will not show up in scans from most anti-spyware products yet.

As well, I probably needn’t bother telling you that I don’t recommend installing the upcoming new version of G-Archiver when it is released, even if the “flaw” is “corrected.” Same goes for other sketchy third-party applications that promise to download messages from any webmail service… provided you give them your name and password. Not all are spyware, to be sure, but you should still tread lightly in this area.