My own experience with USB viruses was pretty thankfully not horrible, but annoying and disheartening. I brought a USB key full of pictures to a local store to have them printed, and when I got back home and put the stick in I was infected. Nothing serious, and easily detected and cleaned, but still annoying. I called the store to let them know, and asked to speak to someone in IT. After I while I talked briefly to a tech, let him know what I experienced, and suggested they turn autorun off, as it wasn't necessary.
Shame on me, because two weeks later I went to print more pictures from USB, and yet again my key was infected. This time I had turn off autorun for USB (different and harder to turn off than for CD I found) and found the infection before it spread to my desktop. No I have what another user suggested in a directory named autorun.inf with all the flags on (system file, read-only, etc). Works for me.
What I wondered about at the time is what one can do when you know of a virus vector, have informed that infected party, and they take no steps to prevent it. Are there places out there where knowing you have a virus, know you're spreading it, and don't do anything is illegal?