Hello, I have a PC in my organization where Nod32 v.4 is running.
In the last 3 days it is showing an alert about Win32/Ramnit.CS virus found in operating memory=c:\windows\system32\wups.dll
it seems to happen randomly during the day.
I tried the offline scan using latest image of ESET SysRescue Live, updated when started, and it founds 0 threats.
Then I let the user work again on the PC, but after some hours again the alert was popped up.
I asked the user about his activities ant everything seems ok. What other problems could make the malware remain on the pc after a SysRescue scan?
Thank you all for the support.