Process "User Memory" belongs to virus/spyware 'Troj/KvterMem-A'.

Our organization also experienced sporadic instances logged of this malware in propagation, but are now unable to substantiate any additional information or retrieve any Sophos related materials in regards to the Malware or what actually occurred.

Same for us.. I got almost 2000 notifications starting last night around 10pm and running through until 4am this morning.

From our investigation, it may be a false-positive. It affected only our machines with instances of Incredibuild software in place.

Thanks. Incredibuild was the common thread on our systems that alerted, too.

restarting the incredibuild services on the affected assets appears to resolve the removal of the false-positive file as well.

We saw the same thing last night/early today, except we don't use Incredibuild

We also got some of these alerts. It was a False Positive, this has been confirmed by Sophos' support:
____
Good afternoon
please note that this is a f/p, , a Fix for this was already released.
The Fix is contained in this IDE file
A fix for the Troj/KvterMem-A false positive was published in:

msil-fnt.ide

Revision: 0
In data version: 5.25
Created: Wed, 03 Feb 2016 12:03:49 +0000
Finished: Wed, 03 Feb 2016 15:29:59 +0000
_____________


I hope this helps.