Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following entries show up in DriverView on my PC:

  • C:\Windows\System32\Drivers\dump_dumpata.sys
  • C:\Windows\System32\Drivers\dump_dumpfve.sys
  • C:\Windows\System32\Drivers\dump_msahci.sys

These files do not exist or are hidden.

I didn't find anything specific on the net about these files. Anyone knows if they are legit?

The OS is Windows 7 professional.


share|improve this question
according to my search Dump_diskdump.sys is a driver for creating disk crash dumps but i still wonder where this driver come from! – AminM Sep 9 '14 at 11:07
up vote 5 down vote accepted

No, you don't have a rootkit. This is how a freshly installed Win 7 SP1 looks like for me:

enter image description here

  • dump_dumpfve.sys is part of Win 7
  • dump_iaStor.sys is part of a driver I installed. Intel Storage something something

In your case additionally:

  • dump_msahci.sys has to do with AHCI driver.
  • dump_dumpata.sys has to do with PATA, otherwise known as Parallel ATA, I'd hazard a guess that the dum before pata in dumpata stands for dummy, but I dunno.

In short, no, you don't have a rootkit.

share|improve this answer
tnx for answer but why this driver haven't Description or File type or other meta-information?? – AminM Jan 17 '14 at 5:14
Lazy developers? Who knows. Many reasons. – Grumpy ol' bear Jan 19 '14 at 10:43
but as you say dump_dumpfve.sys is part of Win Microsoft Lazy Developer??!?!? – AminM Jan 19 '14 at 12:01
These are probably "emergency" drivers loaded to support dumping memory to disk upon a blue screen. – LawrenceC Mar 7 '14 at 12:04

I was looking for an answer concerning these same drivers that were shown in nirsoft DriverView

according to the Driver Reference Table found at John Carrona website, Microsoft MVP


%SysDir%\Drivers\DUMP_DUMPATA.SYS is related to Microsoft Windows Vista.
DUMP_DUMPATA.SYS is a system driver for managing ATA devices. 


%SysDir%\Drivers\DUMP_DUMPFVE.SYS is related to Microsoft Windows Vista.
DUMP_DUMPFVE.SYS is a Full Volume Encryption Crashdump Hibernate Filter Driver.
DUMPFVE.SYS is a part of Microsoft® Windows® Vista Operating System. 


DUMP_MSAHCI.SYS is related to MS AHCI 1.0 Standard Driver.
DUMP_MSAHCI.SYS is a part of Microsoft® Windows® Operating System.
Manufacturer: Microsoft Corp.

seems to be they are all related to dump files and legit,but I don't know for certain myself,it might be helpful to another

windows 7 SP1

share|improve this answer
That website is awesome. Took me a while to work out why the layout seemed a bit spartan tho – Journeyman Geek Jun 15 '12 at 7:12

According to Kaspersky it is not trusted but I have not been able to delete C:\windows\System32\Drivers\dump_dumpfve.sys

share|improve this answer
The other two answers claim that, unless changed by some malware, the original file is trusted. So where does Kaspersky say it's not? In a virus scan? Are you actually posting this to answer the question, or are you asking for help? – Arjan Sep 12 '15 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .