Assuming that I'm using a trusted USB flash drive (meaning that it's not some device that looks like a USB drive and whose purpose is to damage my PC), is it possible for my PC to get infected from some malware picked up by the USB if I'm running an antivirus program that doesn't allow any autorun.inf files to run from the USB drive? I have two PCs, one running Windows 10 and the other running Windows 8.1.
Short answer: YES
You can be infected even with a full patched Windows system and an updated antivirus. This happened before and can happen again.
A few years ago, the Stuxnet worm was specially engineered to attack the Iranian nuclear facilities. They got hit by using infected USB drives, without
autorun.inf or executing anything by hand.
Those vulnerabilities are called zero day. The attacker knows it, but the vendor and antivirus companies does not. But those vulnerabilities are very prized, and will not be used on a low-value target, because as soon as the attack is detected, it's not a zero-day anymore.
If you are not a high-value target, you usually don't have to worry about being hit by a zero-day. Usually you will get hit by an social engineering attack, and probably will step onto the trap by yourself, like opening an executable file with the icon of a pdf or a picture...
- BadUSB turns benign (USB) devices into malicious monsters by reprogramming the controller chips. This is on a much lower level than the 'autorun' feature that you are talking about.
- USB Rubber Ducky is another, comparable threat.
- Like ThoriumBR said, any host machine can be exploited by some unknown zero-day vulnerability.
There are not many practical ways to protect against this [BadUSB] type of attack. Most of them heavily impact user-friendliness:
- Blacklist USB devices
- Prevent automatic installation of USB devices
- Disable inactive USB ports