There have been a few virii/trojans exploiting the holes in Microsoft's VM. It has been well documented.

http://www.helpbytes.co.uk/java.php
http://www.windowsitpro.com/Article/ArticleID/26623/26623.html

Read the following from Microsoft:
http://www.microsoft.com/mscorp/java/

"The MSJVM will reach its end of life on December 31, 2007"

Looks like migrating to Sun's JVM now is better than later as "The MSJVM is no longer available for distribution from Microsoft and there will be no enhancements to the MSJVM."