14

I have to admit to a less than perfect understanding of dumprep, but here goes.

You probably know dumprep is responsible for error reporting. If an error report is generated under a non-privileged user account, however, it does not get reported immediately even if the user clicks OK. Rather, it’s put in an error queue waiting for an administrator to log in. This is done both to prevent the non-privileged user from potentially seeing the data and because only an admin is given rights to send this data. So at this point an HKLM Run key is written to the registry to run dumprep at start up until an admin can deal with it.

Now, if an admin doesn’t log in, or logs in but doesn’t respond to the error notice within a finite time frame, or does respond but there is an error removing the run key, it stays as a startup item indefinitely. I suppose blocking it in the firewall might even cause this condition, but this is a guess.