Hmm... interesting question.
Yes crackers can break systems that don't have a pre-installed trojen or whatever.
For instance take a look at the DCOM vunerability that was built into windows. The worm is a automated program that seeks out this vunerability and breaks the software and inserts code into the memory of you machine enabling it to install itself onto your computer.
Now what if a cracker knew this before hand? Before LSD discovered it and told MS about it?
They could of crafted a program that would of done the exact same thing as the worm, but instead of being a generic program for every windows machine it would be customized for your computer making it much more effective. If a cracker knew about this before LSD he could of had free run of every Windows computer out there that was not secured behind a firewall.
Let me put this another way. Practicly all machines that were hit with the worm suffered from a lack of security. A human is 100x's more dangerous and harder to keep out.
A worm or virus is the most basic attack that could possibly be performed on a machine. And the easiest to counteract.
A dedicated attack by a expert is almost impossible to keep out using passive means like software firewalls or virus scanners. A hardcore professional --somebody who actually makes a living cracking computers-- will spend months and months studying every aspect of a computer/network system until they find that one weakness that will allow them in. Weither that weakness is human/hardware/software it doesn't matter. The only way to stop that is by having a equally knowledgable expert on your side.
People are paid sometimes hundreds of thousands of dollars sometimes to crack computers. And lots of times it's perfectly legal. Say you are in a large corporation and a VP is incharge of a critical business account worth millions of dollars. You buy the most secure custom peice of software and hardware possible to store info on. Something so secure not even the manufacturer could get the computer back under control without ruining your data, or maybe it is so top-secret you can't risk OEM'ing it. Corporate spys are everywhere.
Now that VP gets run over by a buss, and your locked out because only he had the password, memory only, and now he is dead. Or quit, Or sold out, Or in jail, Or got fired, Or whatever. Then you hire a professional hacker.
People like that are what you should worry about if you do security for a living. Viruses and worms are things of that nature are just nuiscenses. Now if you have a computer/network that was violated by a worm or a virus, then you've got some major problems if your lively hood depends on that information. A human attacker can get in and out probably unnoticed.
You know I am not trying to be all high and mighty or anything. Stuff happens, we are all humans. And to err is unavoidable. People will always make mistakes, weither it's windows, linux, unix, firewalls or whatever. Which is why crackers will always exist no matter what. Just remember when Software manufactures claime to have products that are hacker-proof... they are just blowing smoke up your you-know-what.
But this is just to answer your question.
The latest vunerability could allow any human to gain control of your computer. A cracker working your computer over has things like root kits (yes windows has root kits, win9x/NT wasn't complex enough to need root kits, there was no point. But w2k was enough so that some people actually created some.) That are so sophisticated that even the best virus scanners would not be able to detect it. (advanced root kits will actually sit between the kernel and the software of the OS and intercept system calls to mask it's identity from everything. Windows does not normally have tools advanced enough so that a knowledgable admin can detect it. A root kit is a trojan on steroids.)
Luckly most (95-99%) of what we have to worry about are rank amatures known as script kiddies. These little dorks think they are "hackers" because they can break a random computer out of 1000 using scripts created by more advanced people. A nice software firewall, or even better yet a physical router are enough to keep these jokers out.
PS. The only really good anti-virus software I can recomend with no hesitation is
this
Facebook
Twitter