TL;DR: Yes, it is possible for an attacker to fingerprint your system and yes it will help him to attack your system. So you should correctly protect your system (an antivirus is not enough).
How does fingerprint work ?
There are different kinds of fingerprint, mainly fingerprint at network level and application level.
At network level
Operating systems does answer differently to use cases not precisely defined in standards. For instance, there are different options allowed by the TCP protocols and each operating system uses different ones. So it is possible to fingerprint a system either actively (by generating custom packets sent to the host, for instance with the tool nmap) or passively (by listening packets with a tool like p0f).
If you consider only your home laptop, it's not a big deal as long as you are protected by a correct firewall (many home routers now block all incoming connections).
If you also consider servers, it's more complex and several solutions have been developed to defeat fingerprinting however they are often complex and mostly outdated (look this article)
At Application Level
On server side, many services give very precise informations in banners (for instance Apache/2.0.48 (Fedora) Server at 127.0.0.1 Port 80 for an appache web server) and you should take care to correctly configure your services to disable these banners (and of course disable useless services).
On client-side, the most critical application is your web browser as 99% of your traffic uses it, and it is really easy to fingerprint your browser:
- Your browser gives his name and version in each request through the User Agent parameter. You can modify it with browser addons
- Even without the user agent, it is possible to gather a lot of informations about your systems through your browser (screen size, fonts, extensions...). The EFF has proven with its application panopticlick, that it is possible to uniquely identify >99% of browsers
So what ?
It's not such a big deal as such informations only help attackers but it won't allow them to compromise your system. It gives them the address of your house not the keys.
So you should restrict informations available by attackers when possible but first, you should take care to correctly protect your system
How can you protect your system ?
Antiviruses are really badly efficient, it's trivial to modify a malware so that it won't be detected by 99% of antiviruses. You should follow a list of best practices to avoid attacks :
- Update your system and applications : this is the #1 rule ! On unix-like systems, you can rely on the package system. On windows, a tool like Secunia PSI can help you to identify the vulnerable softwares. The most critical softwares are your browser and its plugins (Flash, Java, Silverlight...) so keep them up to date all the time
- Use strong password and use different password for different websites : there are a lot of password leakage nowadays so you should take care of your passwords. A tool like keepass to securely store your password can be helpfull. Also use two-factor authentication when possible
- Use a personal firewall : even if you should be most of the time behind a home firewall, it is always useful
- Use an antivirus : to my mind, don't spend money on it but there are free antiviruses on Windows
- Be smart on Internet : take care of weird emails, weird web sites...
So it is definitely dangerous to continue using Windows XP after april 2014, you should really consider upgrading (or moving to another OS).