It's been two long arduous months and my computer has finally been returned to me. I suffered through the worst customer experience of my life, and I have to pull everything together once again. I had to take my computer back to this worthless technician five times, each with the same problem. The symptom was the same each visit, but the cause always seemed to be something off the top of his head; he certainly made a point to openly blame me every single step of the way, accusing me of everything from downloading pirated content to singlehandedly dismantling my own computer to break it intentionally just to get free service.

Long story short, he eventually 'discovered' the real reason for my 1962: He claims that one of the programs I downloaded/installed had a virus that "knocked the drive out" and caused it to crash. Now yes, I am aware I had a lot of programs installed, but most of them(i.e. Steam Games, Microsoft Store, software websites) were direct, from trusted sites and not from 3rd-party mirrors. Anyway, he told me that the virus was embedded in one of my programs, and he didn't know which. He also told me that no virus scanner could find it, "being so deeply buried, even Microsoft wouldn't be able to find it".

I told him I have a copy of all my application setups on my external hard drive, and asked him why the virus wouldn't attack the external hard drives, and he said the virus would know the difference and would not activate until installed on an actual computer. He basically said the only way I could find out which program has a virus is after the virus attacks and destroys my computer again.

What he said seemed to make some sense, but then again this guy is a crook. What doesn't make sense is that out of all the programs I've installed over so many years and so many computers, I've never had a problem with any of them--I'm about 65% sure I didn't install any programs between November and December, when I first started getting these messages.

So is it true?

1) Can a virus differentiate between an external hard drive and an internal one and know when to strike?

2)Can nothing stop--or at least find--something like this??

3) Is it possible for a virus to have a "scheduled release"? Maybe something I installed a long time ago and only started attacking recently?

4) Can a virus really wipe out a whole operating system, and why?

5)Most importantly, is there really no other way to find out the identity/location of the virus than play Minesweeper with my applications and guarantee another two week billion dollar service by someone else?

Short answer is yes, pretty much all of those are true. :(

#1 -- yes, because your computer's OS can. a virus doesn't have to write this functionality (though it can), it can piggyback on existing functionality to do this.

#2 is the most controversial one in your list. There are various ways viruses hide, and the only real way for a virus checking program to be sure is to find pre-existing patterns. There are always new ways to hide and new vectors of attack, so for a time at least, viruses can go undetected. So the more common (and more destructive) the virus, the more likely it can be caught and quarantined.

#3 is definitely a thing. Think of the "malware" that threatens to encrypt your HDD unless you pay someone off. That's essentially a timed virus. A virus is just like any other computer program -- it can be written to do all sorts of things, including check the time and date. Either via the internet or, more likely, your system clock.

#4 is an absolutely yes. It can go even further, and make hardware unusable. Your operating system is jsut a framework of programs that give better "context" and functionality to other programs. So, for the same reason that a text editor can load and save files on a HDD, a virus can use the same kinds of system calls to get that job done. But back to your question, if the data or files that the operating system needs in order to run properly get mangled, erased, or otherwise corrupted by a virus then you can potentially not run your OS properly. Your HDD, motherboard and other components often also have their own mini-harddrive like storage that they use to run themselves off of. A virus can hide in those or corrupt them as well, potentially making them expensive paperweights.

#5 gets kind of back to #2 -- it dpeends on the virus and what it does. The worst kind inject themselves into other kinds of files (or even spread across multiple files) and can lay dormant until those files are accessed and the virus gets activated. I've heard of some viruses using "bad sectors" on the HDD to hide information in as well. So if you know what virus you're looking for and what it does then yes, you can go after it. But some of the worst adapt themselves to your system so there is no easy way to say "look here, here and here for the virus". You can keep paying someone to keep digging, but it becomes a matter of diminishing returns at that point.

It's a little like identity theft -- the system is built to assume trust, and once it's broken it's hard to get everything back to "trusted" status again.

Sounds painful, I hope you got everything you need back...!

So is it true?

1) Can a virus differentiate between an external hard drive and an internal one and know when to strike?

Sure. I've had legitimate programs tell me that they don't want to or can't run on an external drive. If a program on the up and up can detect that sort of thing surely a virus can.

2)Can nothing stop--or at least find--something like this??

Depends on what virus you have. Maybe you have Stuxnet, for instance. That one is pretty tricky to stop...

3) Is it possible for a virus to have a "scheduled release"? Maybe something I installed a long time ago and only started attacking recently?

Absolutely. Sometimes viruses hide for a while so big company backup systems will back them up. That way when they do activate, restoring from a backup is useless because all the backups for the past three months are infected too.

4) Can a virus really wipe out a whole operating system, and why?

Yes. Operating systems are just files. Viruses can delete and damage files. Some viruses will delete the part of your file system that tells the computer where all your files are. Other viruses might just encrypt your files then make you pay a ton of money to get the key that unlocks them.

5)Most importantly, is there really no other way to find out the identity/location of the virus than play Minesweeper with my applications and guarantee another two week billion dollar service by someone else?

Try Geek Squad.

While all of that is certainly possible, it sounds to me like the guy is making stuff up.

- No text -

if most of your purchases are on steam/microsoft store, then just re-download them. If any of your software came on a disc, reinstall from the disc then download updates for them.

So is it true?

1) Can a virus differentiate between an external hard drive and an internal one and know when to strike?

TBH, this is probably the wrong question. I think that either the technician explained it badly, or you mangled his explanation. I believe what he was trying to get at (assuming he isn't just plain crazy) was that those stored copies of programs on your external drive are not actually RUNNING. The thing to understand is that files on a drive are JUST files, until they are executed. If you are not actually browsing to the external drive and running the programs from that location, then those files are most likely not doing anything.

It's not a question of the virus actively thinking "am I on an internal or external drive" and then making a decision about whether to execute an attack. It's simply a matter of whether it ever runs in the first place.

2)Can nothing stop--or at least find--something like this??

Others have sort of already covered it, but the answer is along the lines of "maybe" or "eventually." There is no magic identifier to say whether content is good or bad. Antivirus programs identify things based on known patterns, and if something hasn't been seen before and identified as a malicious actor, then no, they probably won't identify it. There is a concept known as "heuristics" where they will try to identify software that behaves in a suspicious matter, but that's still just pattern matching. Based on behavior rather than specific content, but still kind of relying on known quantities.

3) Is it possible for a virus to have a "scheduled release"? Maybe something I installed a long time ago and only started attacking recently?

Of course it's possible. I mean, your computer does know the current date, doesn't it? That being said, it's not usually how things work. It's more likely that you simply didn't execute a given file until recently.

An alternative explanation is that it wasn't actually from any pirated software. You may have gotten infected through some other vector such as an email attachment or a compromised website (compromised ads are a thing, too), and the technician simply saw some illegitimate software and ASSUMED that was the source, because it's a common vector.

4) Can a virus really wipe out a whole operating system, and why?

Yes, of course. The "can" part is kind of a silly question, no offense. I mean, anything that can write data to the hard disk can potentially damage files. The more significant question is "why," and the answer there is that it's usually not intentional. The thing from 80's movies where a big skull comes up on the screen and your computer dies doesn't really happen, mostly. Most malicious software is designed to either steal information (passwords, account numbers, etc.) or to take over the affected PC in such a way that it can be given instructions remotely - these are the "botnets" you hear about, comprised of many infected machines, which are collectively used to DDoS various services (among many other tasks, that's just a well-known example). So, as you can imagine, the people making these things do NOT want your PC to stop running. The ideal scenario for them is that the PC continues to run, continues to be connected to the internet, and (in the case of keylogging/information siphoning) even continues to be used. Typically when a virus causes a PC to stop working, it was an accident. The software was probably trying to modify the system, either to hide itself or simply to accomplish whatever purpose it has, and the author simply failed to account for some particular condition present on that machine. Odd as this may sound, virus authors aren't as concerned about damaging PCs as legit software companies, and as a result, their quality control sometimes isn't as good. :P

The partial exception here is a relatively new breed known as "ransomware." These things encrypt your files. If you're not familiar with encryption, it basically means they're scrambled in such a way that they can't be opened without decryption software and a specific key. They then demand a ransom payment in exchange for the decryption instructions (and key). I say that this is a partial exception because they aren't intended to actually stop the PC from running. They still want the OS to generally run, so that you can get to a point where you SEE that your files won't open, and can read their ransom demands (which are typically placed in the same folder as encrypted files). For this reason, ransomware typically only targets certain file extensions which are commonly used for information people might find important (or of sentimental value - think family photos), but are NOT critical for the system to operate - .JPG, .DOCX, .PDF, etc.

5)Most importantly, is there really no other way to find out the identity/location of the virus than play Minesweeper with my applications and guarantee another two week billion dollar service by someone else?

What is the current status of your PC? Is it running? If so, I would simply let it run for a few weeks without installing anything that isn't a KNOWN OK program straight from the manufacturer, and don't execute any programs stored on the external drives. I know it might be hard to do without some things, but just go with it. Periodically scan your external drives with Malwarebytes. If there is something new out in the wild, that will probably eventually be updated to find it. Of course, not having inspected your PC myself, I can't verify whether there actually WAS a virus. Also, make a backup of your PC in its CURRENT state. I don't mean manually copy files to an external drive, I mean a proper system image backup, that stores the EXACT drive contents. Keep that backup disconnected when not in use. The intention here is that if something does go wrong later, you could put the PC back to a working state with relatively little effort.