← All drivers
Field Guide · Family
OPSWAT
OPSWAT (San Francisco) makes MetaDefender, AppRemover, and the OESIS Framework, enterprise endpoint-posture and application-management tools. AppRemover is the application-removal utility used by MSPs and endpoint-security teams; its kernel driver (ardrv.sys) has sixteen historically signed builds on the public LOLDrivers list after a disclosed 2026 vulnerability (CVE-2026-36425), and OPSWAT's successor driver (libwasys.sys) carries the hardening in version 10.3.5429.0 and later.
16
Drivers
16
Vulnerable
0
Malicious
16
With Field Notes
ardrv.sys
vulnerable✎
libwasys.sys
vulnerable✎
ardrv_1.sys
vulnerable✎
ardrv_10.sys
vulnerable✎
ardrv_11.sys
vulnerable✎
ardrv_13.sys
vulnerable✎
ardrv_14.sys
vulnerable✎
ardrv_15.sys
vulnerable✎
ardrv_16.sys
vulnerable✎
ardrv_2.sys
vulnerable✎
ardrv_3.sys
vulnerable✎
ardrv_4.sys
vulnerable✎
ardrv_6.sys
vulnerable✎
ardrv_7.sys
vulnerable✎
ardrv_8.sys
vulnerable✎
ardrv_9.sys
vulnerable✎
Family grouping is Vera's. Status data comes from the public LOLDrivers project.