Note that that the pendrive itself is potentially "infected" too, sometimes there are OS and file manager bugs resulting in code execution without the user clicking anything.