Shouldn't preventing this be as easy as turning off autorun? In fact, I thought Windows had that off by default for USB devices.
(Of course, I'm assuming we're not dealing with a zero-day in the USB stack or filesystem drivers. But that probably is something that the Secret Service should be on top of, as well.)