Actually W'On you were close. Try doing a search in the Registry for keys with "wink" in them. Start>Run>Regedit>Find "wink"

Here's a clip from a virus encyclopaedia:

When the attachment is executed, the worm drops a copy of itself into the System directory. It then sets up a registry key to run itself on Windows startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\="C:\WINDOWS\SYSTEM\"

The file name and registry value name are identical, and are randomly generated, but always begin with "Wink". For example, "Winkhj.exe".