5

So, I have an iMac 27" Late 2012, and I have just installed Windows 10 Home 64Bit through BootCamp. BootCamp comes along with several "support software", useful drivers made for Windows and Apple hardware. I have recently noticed that one of the drivers mounts and makes read-and-writeable drives that are formatted in HFS+, including my Mac drive (which appears read-only) and an external HDD I make backups to. Since I'm afraid of Windows Ransomware, I'd like to remove any access to HFS+ drivers from Windows side of things. Is there any way to remove (or at least disable) the driver that enables HFS+?

klanomath
  • 66,391
  • 9
  • 130
  • 201
Manchineel
  • 751

1 Answers1

8

AFAIK the Apple HFS+ drivers are read-only. You may have installed another read/write driver like Paragon.

To remove Apple HFS+ Driver:

  1. Browse to C:\Windows\System32\drivers\
  2. Move AppleHFS.sys & AppleMNT.sys to the Recycle Bin

  3. Create a Remove_AppleHFS.reg file with a text editor like NotePad and the following content:

    Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AppleHFS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AppleMNT]

    You may have to add a trailing empty line.

    Merging a reg file with the registry should work as following:

    • Click on Start and then Run...
    • Type in regedit, and then press OK
    • In regedit, click on File, and then Import
    • Enter the filename or otherwise locate the ".reg" file you want to enter, and press OK
    • The contents of that ".reg" file will be entered into the registry.

  4. Restart

klanomath
  • 66,391
  • 9
  • 130
  • 201
  • Thanks for the reply. Can you please explain how I can Merge it with Windows registry (I never used Windows before, only GNU/Linux and Mac). Also, doing so am I REMOVING the driver or making a kind of "script" to DISABLE it? – Manchineel Apr 04 '16 at 20:22
  • @alex2003super Moving AppleHFS.sys & AppleMNT.sys to the Recycle Bin and emptying it removes the files. Removing the reg entries is the clean-up work to delete unknown reg entries. – klanomath Apr 04 '16 at 20:28
  • paste that code into a file in notepad and save it with a .reg extension. Then double click on it to apply the changes to the registry. – Steve Chambers Apr 05 '16 at 00:16
  • And, what do you mean by "trailing empty line"? – Manchineel Apr 07 '16 at 15:28
  • @alex2003super Some files need a new empty line to work properly. But I can't show this properly because empty lines at the end of a code section are just suppressed in the presentation here! Example – klanomath Apr 07 '16 at 15:34
  • This actually solved a long standing VSS-problem for me on my "genuine" Windows 10 machine also. It prevented restorepoints and also cloning and backups of the system partition, since many backup software uses VSS. Thanks! – thoni56 Mar 10 '19 at 11:26