SMTMP has folders only

A customer of mine brought in a Vista computer with the empty Startup folders, etc... I quickly located the smtmp in the user temp folder. It contained smtmp 1, 2, and 4. It did not contain smtmp 3.
However, smtmp 2 and 4 were both empty and smtmp 1 contained only folders. All the right folders were there but they were empty. I ran Unhide twice. MalwareBytes removed several malwares. But, I still could not locate the contents of the individual folders.

Is it possible that one virus rewrote the smtmps after everything was already hidden?

One more thing to add here. This customer signed up for a program called Swag Bucks that claims to pay you for surfing the web. The CouponsBar was installed at the same time. I had to uninstall CouponsBar twice as it quickly returned the first time.

I painstakingly rebuilt most of the shortcuts or copied them from their other computer. But I would like to know if there was another way. I do not have any attachments to include as they needed the computer back quickly to run their business accounting.

Thanks,
Ron

You could go to Grinler's "Unhide" page, arrow down to the bottom and download the appropriate windows version of "SM-Reset.exe."

Download recuva

http://www.filehippo.com/download_recuva/

Install it and when you get the recuva screen

Click Cancel on the wizard.
Click on Options... >> Actions Tab. Check "Restore folder structure."

Now click on SCAN

When complete, use the filter box in the upper right corner and type

smtmp

if smtmp doesnt yield any results type

*.lnk in the search option

Select all the LNK files and recover them to a folder.Browse through the folder.

You should find the SMTMP folder .You can copy the programs to appropriate place

Good luck