What exactly is a filter driver?
Everything you ever wanted to know (and probably more than you ever wanted to know) about storage filter drivers:
http://msdn2.microsoft.com/en-us/library/ms803150.aspx
Simple explanation:
A
filter driver is a driver that sits in between two drivers on the driver stack or on top of the driver stack for a particular device.
For example, a hypothetical driver stack for a device could look like this:
program -> OS -> device driver -> controller driver -> PCI bus driver.
A filter driver could load itself like this:
program -> OS -> filter driver -> device driver -> controller driver -> PCI bus driver
And so be able to monitor or alter requests coming from the OS or the data being returned to the OS by the device.
There are many different kinds of filter drivers: network, storage, audio, etc, and they are normally extremely useful for legitimate purposes. For example your firewall or your antivirus program will probably have filter drivers of some sort installed on your system.
A
storage filter driver is a specific kind of filter driver that sits in between the file system and the driver for your storage device, and has the power to monitor or optionally modify the IO requests that come from the filesystem.
An
optical storage filter driver is a storage filter driver that only attaches to driver stacks involved with optical media.
These types of drivers are commonly used by CD burning programs to allow them to send normally unsupported commands directly to the drive, copy protection systems to monitor and/or intercept requests to the drive, diagnostics programs to monitor the IO requests going up and down the stack, ISO-mounting tools to redirect requests to a file instead of letting the requests go to the device, etc etc etc.
Since they are kernel mode components, they can be somewhat tricky to write correctly, and so many filter drivers can have bugs. Also, since they are kernel mode components they have full access to the entire system, and thus can be used for nefarious purposes. For example, one component of the Sony rootkit was a filter driver that attached to your file system, and prevented it from returning files with certain names.
One last thing, when you said that your computer crashed if you eject the CD, do you mean on modern Windows (2000/XP/2003/Vista) and do you mean bluescreen for real or just Explorer crashing?
Because if it's just Explorer crashing it's probably not a filter driver causing it, but possibly an Explorer extension. (Or maybe a bug in Explorer itself.)
And here is more information that you probably ever wanted to know about Explorer extensions:
http://msdn2.microsoft.com/en-us/library/aa969287.aspx