BrownB posted a topic in Malware Finding and CleaningHello, I have a PC in my organization where Nod32 v.4 is running. In the last 3 days it is showing an alert about Win32/Ramnit.CS virus found in operating memory=c:\windows\system32\wups.dll it seems to happen randomly during the day. I tried the offline scan using latest image of ESET SysRescue Live, updated when started, and it founds 0 threats. Then I let the user work again on the PC, but after some hours again the alert was popped up. I asked the user about his activities ant everything seems ok. What other problems could make the malware remain on the pc after a SysRescue scan? Thank you all for the support.