Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The following entries show up in DriverView on my PC:

  • C:\Windows\System32\Drivers\dump_dumpata.sys
  • C:\Windows\System32\Drivers\dump_dumpfve.sys
  • C:\Windows\System32\Drivers\dump_msahci.sys

These files do not exist or are hidden.

I didn't find anything specific on the net about these files. Anyone knows if they are legit?

The OS is Windows 7 professional.

Thanks.

share|improve this question
    
according to my search Dump_diskdump.sys is a driver for creating disk crash dumps but i still wonder where this driver come from! –  Jeson Park Sep 9 at 11:07

2 Answers 2

up vote 3 down vote accepted

No, you don't have a rootkit. This is how a freshly installed Win 7 SP1 looks like for me:

enter image description here

  • dump_dumpfve.sys is part of Win 7
  • dump_iaStor.sys is part of a driver I installed. Intel Storage something something

In your case additionally:

  • dump_msahci.sys has to do with AHCI driver.
  • dump_dumpata.sys has to do with PATA, otherwise known as Parallel ATA, I'd hazard a guess that the dum before pata in dumpata stands for dummy, but I dunno.

In short, no, you don't have a rootkit.

share|improve this answer
    
tnx for answer but why this driver haven't Description or File type or other meta-information?? –  Jeson Park Jan 17 at 5:14
    
Lazy developers? Who knows. Many reasons. –  Don Salva Jan 19 at 10:43
    
but as you say dump_dumpfve.sys is part of Win 7.is Microsoft Lazy Developer??!?!? –  Jeson Park Jan 19 at 12:01
    
These are probably "emergency" drivers loaded to support dumping memory to disk upon a blue screen. –  ultrasawblade Mar 7 at 12:04
C:\Windows\System32\Drivers\dump_dumpata.sys
C:\Windows\System32\Drivers\dump_dumpfve.sys
C:\Windows\System32\Drivers\dump_msahci.sys

I was looking for an answer concerning these same drivers that were shown in nirsoft DriverView

according to the Driver Reference Table found at John Carrona website, Microsoft MVP http://www.carrona.org/dvrref.php

dump_dumpata.sys

%SysDir%\Drivers\DUMP_DUMPATA.SYS is related to Microsoft Windows Vista.
DUMP_DUMPATA.SYS is a system driver for managing ATA devices. 

dump_dumpfve.sys

%SysDir%\Drivers\DUMP_DUMPFVE.SYS is related to Microsoft Windows Vista.
DUMP_DUMPFVE.SYS is a Full Volume Encryption Crashdump Hibernate Filter Driver.
DUMPFVE.SYS is a part of Microsoft® Windows® Vista Operating System. 

dump_msahci.sys

DUMP_MSAHCI.SYS is related to MS AHCI 1.0 Standard Driver.
DUMP_MSAHCI.SYS is a part of Microsoft® Windows® Operating System.
Manufacturer: Microsoft Corp.

seems to be they are all related to dump files and legit,but I don't know for certain myself,it might be helpful to another

windows 7 SP1

share|improve this answer
    
That website is awesome. Took me a while to work out why the layout seemed a bit spartan tho –  Journeyman Geek Jun 15 '12 at 7:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.