The virus/scareware may hide the start menu links in
c:\documents and settings\<infected User name>\Local Settings\TEMP\SNTMP ( Windows XP )
Make sure you do not run any temp cleaners as it will delete this folder and all your links!!
If you have ran combofix already!! Check the Qooo folder under Quarantine and look for that path mentioned above.
Folder will be named
1 2 4 etc etc
All shortcuts and .lnk's will be listed in there.
1 = Start Menu Program shortcuts
2 = Current User Quick Start shortcuts
4 = All Users Desktop folders and shortcuts
--------------------------------------------------------------------------------
Vista and Win7 Shortcut Links!
C\Users\Infected User\AppData\Local\Temp\smtmp