francbelge, with a firewall you will have to actively do something that will get you exploited. With a public IP open to the internet though, yes. I saw a video of some guy connect a freshly installed XP VM to the internet with a public IP. It got infested with all sorts of nastiness in a matter of minutes.