It seems like there is a new Java exploit available, which is now used by some crack sites to change your default browser homepage and your internet security settings. When I noticed this behaviour with my browser, I did a virus scan and my antivirus found some infected java *.class files inside some *.zip files.

Now I'm wondering how Java loads his class files, since my antivirus is set to scan *.class files on access and also scan inside archives. I verified this with by opening the *.zip in winzip, which gave me a virus error. Then I disabled the archive scan and was able to open the *.zip, but I could not extract any of the *.class files because of virus found. So my antivirus works. But Java can load and execute the *.zip and *.class files without my antivirus showing virus found.

So how does Java load his programs?