[forgot-im-old]

It used to be you could put a file called autoplay on a USB drive and it would get executed on insertion.

[vifon]

AFAIK it only worked with optical drives, not pendrives. I've spent hours trying to get this functionality on my pendrives back in the day, to no avail (thankfully!). It was on Windows XP, and Windows 98 needed external drivers to even use pendrives at all, so if such an attack vector existed, it must have been on Windows 2000 or Me (i.e between XP and 98), so an arguably very short time frame (if at all!).

[JD557]

I recall Disk Knight (https://www.lucadamico.dev/papers/malware_analysis/DiskKnigh...) working on Windows XP

I don't remember the whole details, but I believe it installed an autorun.inf file on all USB drives so that inserting the drive on another PC would install it automatically.

[actionfromafar]

You could/can have the USB device appear as a CDROM