Windows Explored

In a large organization, this can actually be quite common. Many a floor support tech has been dispatched to try to correct by physically checking or replacing the drive. The symptom is that the CD\DVD drive letter is missing in Windows. In the vast majority of cases, this is a software issue and can be resolved remotely, without the need for someone to open the system. The cause is the result of class filters becoming corrupted or modified in some way, usually because of a badly written or incompatible driver, firmware update, or after installing CD\DVD burning software.

To correct the issue, navigate to this location in the Windows registry: HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}. Delete the upperfilter and lowerfilters strings and reboot.

When you see this problem, sometimes the name of the filter will be missing or the name will be just plain odd. Beside the registry, you can also check the name of these filters by going into the Device Manager, right-clicking the CD\DVD drive, selecting Properties and going to the Details tab. From here, select either the Class Lower or Upper Filters to see info on it. The image below corresponds to the info in the string above in the registry.

In one case I came across, this issue became repetitive–it was initially corrected by clearing the filters in the registry but then came back again. The issue was tracked down by looking at the class lower filter in the Device Manager which revealed $sys$crater. A quick Internet search of this filter name pointed to a service created in Windows called XCP CD Proxy. This CD Proxy was the infamous Sony DRM RootKit that installed itself onto any system in which a Sony CD with DRM was inserted and played.

The problem was eventually corrected by removing the service via one of the many Sony DRM RootKit cleaners, deleting the filters in the registry again and rebooting … and, of course, telling the user to no longer insert any more Sony CDs that used DRM in the CD drive.