A file named help.pif in the c:\windows\system folder 
is run on boot up out of the registry under a listing of Windows Help Engine.
It is delivered by a file named iQtcy.exe which I found in c:\windows\temp on a 
PC I was working on. I don't know how the file got there but I did find the
JS.Exception.exploit virus once Norton anti-virus was reinstalled.

The help.pif file seems to contain a corrupted version of mIRC 6.02 client
mIRC has been attacked by other worms such as the IRC/Flood trojan virus.

Norton Anti virus does not detect it, Zone Alarm will see it trying to 
communicate. Using the Ethereal packet sniffer  I found
it communicated from ports 1238,1028,1039,
to myuse.isasecret.com : 6667 via TCP, but also seems to try and
use Netbios - it was querying  port137 to
h8m.ath.cx  and nstserv.cjb.net

It has been found before on someones desktop but other then that 
there is very limited info out there. I have submitted the file 
to several anti-virus companys.