Can somebody have stolen files and data from my desktop PC just by inserting a USB Flash drive in my computer, without dragging files over to the Flash drive?
Yes, easily. Removable devices (such as USB, or CD-ROM disks) have "AutoPlay" support on Windows. This is designed to auto-run installation CD-ROMs; just insert the CD and the installer starts.
It works like this: if in the root of the newly inserted device an "AUTORUN.INF" file is found, then its instructions are executed; they may tell the system to display a special, cooler icon for the device, but also to execute a program from the device. Both the autorun file and the program may be hidden so that you don't see them on the device, and it appears empty.
This executable could then do anything the logged-in user can do: it could run a search on the hard disk, and copy matching files on a hidden folder in the USB key. Or install a virus (that's how USB viruses such as Conficker propagate) that could then trasmit files at leisure through the Internet, if the computer was online.
It is easy to write such an autorun INF file using Notepad, and the executable can be built with any of several tools such as AutoIt, or it could even be a .CMD or .BAT file, which too can be created with just Notepad.
There are even "ready made" tools out there, such as, if memory serves, Slurper:
- install the program
- insert the USB key
- choose the file search parameters (e.g. "Files newer than one week")
- click "OK"
- and the utility saves on the USB key an autorun file and executable that...
- ...when you insert the USB key in a computer, will search matching files and "slurp" them on the USB key, optionally even deleting them.
UPDATE: There also happens to be a howto on Superuser.
Workarounds: on Windows XP, keep the "SHIFT" key pressed while inserting the flash drive. This disables autorun execution. Also works on Seven, haven't tried on Windows 8.
(IPQ sells a write-protectable USB key that allows you to let someone copy a file on his untrusted-by-you computer, without said computer being able to infect the USB key with malware. Other WP keys are available e.g. on Amazon).
Could this print shop employee, ostensibly helping me with image/text files for my manuscript, have been actually slurping down data onto his USB, EVEN THOUGH HIS HANDS NEVER TOUCHED MY KEYBOARD,
Yes, it could.
The print shop employee would need to use a specially crafted device which looks like a USB pen drive, and which acts like a regular USB based pendrive for a while.
After that it can suddenly change its appearance and to your computer it now looks as if the pen drive got replaced by a USB keyboard. Since these are common devices no extra drivers are needed and to you (and your computer) it would seem as if someone suddenly started typing commands.
Those commands could be Control+Esc (aka open the start menu) Cursor Up (to get to [run]), then "copy ..."
and my Windows 8 system never had a pop-up box asking for authorization to Install anything?
Windows helpfully does not bother you with such questions when you insert a seemingly common device, such as an USB mouse or and USB keyboard. The device would merely have to mimic one of these.
A local Techno-geek assured me that I was SAFE because these things never happened.
Almost never. But technically possible. Thus I am answering the "is it possible?" with a yes.
It is unlikely though. These things are as common as 007 cars with ejector seats. Just because it is possible to build such a device does not mean that you will run into them. It is much more likely that something else happened, such as an open share on your harddrive and a curious person just browsing around.