Suspicious drivers, is it a rootkit?

Question

The following entries show up in DriverView on my PC:

• C:\Windows\System32\Drivers\dump_dumpata.sys
• C:\Windows\System32\Drivers\dump_dumpfve.sys
• C:\Windows\System32\Drivers\dump_msahci.sys

These files do not exist or are hidden.

I didn't find anything specific on the net about these files. Anyone knows if they are legit?

The OS is Windows 7 professional.

Thanks.

Answer 1

No, you don't have a rootkit. This is how a freshly installed Win 7 SP1 looks like for me:

• dump_dumpfve.sys is part of Win 7
• dump_iaStor.sys is part of a driver I installed. Intel Storage something something

In your case additionally:

• dump_msahci.sys has to do with AHCI driver.
• dump_dumpata.sys has to do with PATA, otherwise known as Parallel ATA, I'd hazard a guess that the dum before pata in dumpata stands for dummy, but I dunno.

In short, no, you don't have a rootkit.

Answer 2

C:\Windows\System32\Drivers\dump_dumpata.sys
C:\Windows\System32\Drivers\dump_dumpfve.sys
C:\Windows\System32\Drivers\dump_msahci.sys

I was looking for an answer concerning these same drivers that were shown in nirsoft DriverView

according to the Driver Reference Table found at John Carrona website, Microsoft MVP http://www.carrona.org/dvrref.php

dump_dumpata.sys

%SysDir%\Drivers\DUMP_DUMPATA.SYS is related to Microsoft Windows Vista.
DUMP_DUMPATA.SYS is a system driver for managing ATA devices. 

dump_dumpfve.sys

%SysDir%\Drivers\DUMP_DUMPFVE.SYS is related to Microsoft Windows Vista.
DUMP_DUMPFVE.SYS is a Full Volume Encryption Crashdump Hibernate Filter Driver.
DUMPFVE.SYS is a part of Microsoft® Windows® Vista Operating System. 

dump_msahci.sys

DUMP_MSAHCI.SYS is related to MS AHCI 1.0 Standard Driver.
DUMP_MSAHCI.SYS is a part of Microsoft® Windows® Operating System.
Manufacturer: Microsoft Corp.

seems to be they are all related to dump files and legit,but I don't know for certain myself,it might be helpful to another

windows 7 SP1

Answer 3

According to SysInternals forum, you do have a rootkit. I would go through the various answers on this site in which tools to use, to remove it.

Examples include:

What to do if my computer is infected by a virus or a malware?

and

Remove rootkit from Windows XP Pro system