Disabling Autorun in Windows does not disable Autorun in Windows.
Basically, you can still get arbitrary code execution by mapping a network drive (it autoruns), choosing "open the folder and view files" when a new device is plugged in, or by double-clicking on a plugged-in device (because the default action changes to "Autorun" if it's got an autorun.inf file, even if the NORMAL double-click action is "open" or "explore")
There's a reg hack to kill it, or you can just avoid doing those three things.
Basically, you can still get arbitrary code execution by mapping a network drive (it autoruns), choosing "open the folder and view files" when a new device is plugged in, or by double-clicking on a plugged-in device (because the default action changes to "Autorun" if it's got an autorun.inf file, even if the NORMAL double-click action is "open" or "explore")
There's a reg hack to kill it, or you can just avoid doing those three things.