Unloading a Filter Driver
The driver object that is associated with an NDIS filter driver specifies an Unload routine called FilterDriverUnload. The system can call the FilterDriverUnload routine when all the miniport adapters that the filter driver services have been removed.
Unload should release any driver-specific resources. Any device objects that the filter driver created must be destroyed. The system can complete a driver unload operation after FilterDriverUnload returns.
The functionality of the unload function is driver-specific. As a general rule, Unload should undo the operations that were performed during driver initialization. For more information about driver initialization, see Initializing a Filter Driver.
A filter driver must call the NdisFDeregisterFilterDriver function from Unload. NdisFDeregisterFilterDriver calls FilterDetach to detach all currently attached filter modules that are associated with this filter driver.
For more information about unloading filter drivers, see Stopping a Driver Stack.