We generally classify a successful attack into two components, inspired from military terminology: the Payload, which when run on the target triggers the malicious effects (hiding, turning your host into a zombie, etc...), and the Vector, which is in charge of executing the Payload. So, are you asking what kind of attack vectors exists ?
In its historical sense, a Trojan relies on the end user as a vector. Before net connectivity was widespread, it usually meant you were tricked into running directly what you would think was a useful program or cool game.
There are other ways code can be run with assistance of the user; for instance, there were a few cases of vulnerabilities in content displaying libraries, such as pdf, jpeg, or flash renderers. If you have the vulnerable program installed, all it takes is for it to attempt to display the toxic content. You could be infected simply when your browser tries to display a .jpg in the page you visit; a malicious .jpg may contain invalid data that will hit a bug in the display library, and maybe end up executing the contents.
In this case, even though you did not click on the malicious program, it is being executed unknowingly by the program calling the vulnerable library (here, your browser.)
Unfortunately we cannot bound the number of possible vectors; every time your system automatically processes content from an unreliable source, there is a risk of a vulnerability being exploited. Against this, your best bet is probably to pay attention to security updates, and practice defense in depth (such as running day-to-day programs with restricted privileges, etc...)