Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following entries show up in DriverView on my PC:

  • C:\Windows\System32\Drivers\dump_dumpata.sys
  • C:\Windows\System32\Drivers\dump_dumpfve.sys
  • C:\Windows\System32\Drivers\dump_msahci.sys

These files do not exist or are hidden.

I didn't find anything specific on the net about these files. Anyone knows if they are legit?

The OS is Windows 7 professional.


share|improve this question
according to my search Dump_diskdump.sys is a driver for creating disk crash dumps but i still wonder where this driver come from! – AminM Sep 9 '14 at 11:07
up vote 5 down vote accepted

No, you don't have a rootkit. This is how a freshly installed Win 7 SP1 looks like for me:

enter image description here

  • dump_dumpfve.sys is part of Win 7
  • dump_iaStor.sys is part of a driver I installed. Intel Storage something something

In your case additionally:

  • dump_msahci.sys has to do with AHCI driver.
  • dump_dumpata.sys has to do with PATA, otherwise known as Parallel ATA, I'd hazard a guess that the dum before pata in dumpata stands for dummy, but I dunno.

In short, no, you don't have a rootkit.

share|improve this answer
tnx for answer but why this driver haven't Description or File type or other meta-information?? – AminM Jan 17 '14 at 5:14
Lazy developers? Who knows. Many reasons. – Grumpy ol' bear Jan 19 '14 at 10:43
but as you say dump_dumpfve.sys is part of Win Microsoft Lazy Developer??!?!? – AminM Jan 19 '14 at 12:01
These are probably "emergency" drivers loaded to support dumping memory to disk upon a blue screen. – LawrenceC Mar 7 '14 at 12:04

I was looking for an answer concerning these same drivers that were shown in nirsoft DriverView

according to the Driver Reference Table found at John Carrona website, Microsoft MVP


%SysDir%\Drivers\DUMP_DUMPATA.SYS is related to Microsoft Windows Vista.
DUMP_DUMPATA.SYS is a system driver for managing ATA devices. 


%SysDir%\Drivers\DUMP_DUMPFVE.SYS is related to Microsoft Windows Vista.
DUMP_DUMPFVE.SYS is a Full Volume Encryption Crashdump Hibernate Filter Driver.
DUMPFVE.SYS is a part of Microsoft® Windows® Vista Operating System. 


DUMP_MSAHCI.SYS is related to MS AHCI 1.0 Standard Driver.
DUMP_MSAHCI.SYS is a part of Microsoft® Windows® Operating System.
Manufacturer: Microsoft Corp.

seems to be they are all related to dump files and legit,but I don't know for certain myself,it might be helpful to another

windows 7 SP1

share|improve this answer
That website is awesome. Took me a while to work out why the layout seemed a bit spartan tho – Journeyman Geek Jun 15 '12 at 7:12

According to Kaspersky it is not trusted but I have not been able to delete C:\windows\System32\Drivers\dump_dumpfve.sys

share|improve this answer
The other two answers claim that, unless changed by some malware, the original file is trusted. So where does Kaspersky say it's not? In a virus scan? Are you actually posting this to answer the question, or are you asking for help? – Arjan Sep 12 '15 at 13:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.