1. Would it be possible for a attacker to gain complete control to a computer without the aid of a Trojan?

Scenario:
No firewall and no router
File sharing is disabled
Windows/IE completely updated

2. If it is possible because of a unknown Windows/IE flaw, would a firewall and or router help?

I am having a debate with someone saying it is possible and I say it is not possible.
Even with a Windows flaw, a firewall is integrated with Windows and it will be bypassed.

Any links provided will be greatly appreciated.

Thank you.