A process can use upto 4 GB of virtual memory (including user and kernel) but when it's not using virtual memory does it have the kernel and user memory in ram?
Using virtual memory is not optional, an application cannot avoid it. Assuming we're talking about x86 protected memory which is what most current operating systems such as Linux, OS X and Windows use on x86.
Basically, each process sees a 4 GB virtual address space (VAS). The OS, in conjunction with the hardware, sets up so-called page descriptor tables (PDT) that describe how that VAS is mapped, with page granularity (typically 4 KB). A page may be mapped to physical memory, it might be mapped to a file (meaning that when the process tries to read from that part of the VAS, it will trap into the OS which will then read the page from the file on disk and place it into memory), or it might not be mapped at all in which case trying to access that part of the VAS will cause the process to crash. And, as an aside, while the kernel memory is mapped into the process, the process cannot access it directly and will crash if it attempts to do so.
And, the OS might use a page file, or swap partition, allowing the OS to move less used memory pages to disk and use the memory for something more useful. Again, if it does this, the PDT's have to be updated accordingly, and similar to memory mapped files, if the process tries to access pages that have been swapped out, it will trap into the OS which will bring the page back into memory. (While the ability to swap is often conflated with virtual memory per se, the fundamental idea behind virtual memory is the concept of the virtual addresses being distinct from physical memory addresses.)