There is little Symantec can do to prevent these trojans from spreading, since they do in fact use a hacked up copy of mIRC and normal mIRCscripts to achieve their tasks.
Then these trojans usually hide a small VB app that triggers AVs to pick up on that virus and then the user thinks they no longer have a virus.
I suggest that included in the mIRC help file and/or on the mIRC website(as well as IRC network websites), and also AV websites, taht users be made aware how to disarm these trojans themselves.
To best determine if you have an IRC trojan, close down all internet connection programs, especially ones you KNOW connect to IRC. Then run a netstat -n, and then see if anything is connecting to an outgoing port of 1024, or ports 6660-7000. Since these are the most common IRC connection ports, chances are they are using it.
Provided that the trojan is using a different port(unlikely), by closing down all internet connectivity programs(browsers, etc), you will see it continually be 'Connected".
Further digging, search the msconfig startup list for anything that's strange(i.e. non-system related files that are in C:\Windows). Another common thing is to name the trojan something like a true windows app, such as rundll32.exe. So make sure that 'rundll32.exe' is not starting up from within some off the wall folder(like c:\windows\systemfiles\rundll32.exe).
If you suspect a program, check the folder and see if there are other related items(maybe some mIRCscripts)...and then cancel the program and delete the folder.
