Latest F-Secure BSOD on Windows 11 24H2
I have been running the Ziggo-branded version of F-Secure for years without issues. Suddenly around April 9th my computer started getting BSOD with error BAD_POOL_CALLER 0xC2. It just wouldn't stay up for more than an hour. Looking into the memory dump file I could see that the error was often in tcpip.sys and ndis.sys drivers so I started uninstalling things that accessed the network like VPN etc. When I finally uninstalled F-Secure the reboots stopped and computer has been stable again.
So something to do with latest Windows Update + F-Secure around that date. Any ideas? I'm scared to re-install again.
Answers
-
Hello,
I think they will advise you to contact Ziggo support since you are using a branded solution.
This can actually help - because their Support are most likely certified to accept diagnostic data from you, for example, such as fsdiag; And then somehow continue to investigate the problem even if with F-Secure directly.
But, just because sounds that such a BSOD can be related with some F-Secure Browsing Protection or whatever things - I do not recall any recent mentions of something like this. Thus, maybe an attempt to install most recent build of Ziggo's branded solution is the only way to check if you still can to reproduce it. And if so - then to contact Ziggo's Support with some created diagnostic files (I am not sure how with branded solution, but mainly you can find it in F-Secure Settings : Support tab : Run 'Support Tool' - it should generate .zip file) with some dumps (if any).
Thanks!
-
I have had exactly the same problem on two different PC's, but with the KPN branded version.
Both on Windows 10 and Windows 11.
Windows boots fine, I can even login. But after about 2-5 minutes BSOD.
When I disconnect the ethernet cable the computer keeps running fine.
I managed to solve the problem by reinstalling the latest network drivers for my on-board ethernet controller.But I'm pretty sure the root cause is F-secure that corrupts the network stack.
-
One PC had a Realtek NIC the other is an Intel I219-V on a MSI motherboard.
I downloaded and installed the Intel drivers from the MSI support site, these are pretty old (2021 ), but it still solved the problem.
So I think the version doesn't really matter, I think just reinstalling the same drivers will also solve the problem.
If you're really looking for newer drivers you can probably download them from the Intel website. -
I have the same issue with an F-Secure-branded F-Secure product, plus steps to consistently trigger the BSOD from an external device. The steps will trigger the BSOD in all of my Windows computers running F-Secure TOTAL regardless of their hardware or non-F-Secure software. It's always a BAD_POOL_CALLER very soon after booting or within a minute of issuing the triggering commands on the non-Windows external computer.
Someone might call it bad product design, someone else might call it a denial-of-service vulnerability.
-
My son had the same problem - computer rebooting all the time with BSOD BAD_POOL_CALLER. As soon as we uninstalled the Ziggo branded F-Secure, it went back to normal. I think F-Secure should acknowledge that there is an issue here and not refer to Ziggo support. The branding surely does not go down to the driver level.
-
"
You're absolutely right to be frustrated — and you're not alone. The BAD_POOL_CALLER BSOD usually points to a driver-level or kernel-mode issue, and in this case, many users have traced it back to F-Secure (especially recent versions or rebranded versions like Ziggo Safe Online). Your logic makes sense: branding by Ziggo is likely just a skin on top of F-Secure's core software, and any kernel drivers — like FsFilter, Wintun, or VPN-related hooks — come from F-Secure itself.
If uninstalling F-Secure resolved the issue, it strongly suggests a compatibility bug or a corrupted install, particularly affecting:
- F-Secure's real-time scanning drivers
- Network filter drivers (e.g., WFP callouts or VPN components)
- Conflicts with Windows kernel memory management, leading to the BAD_POOL_CALLER
F-Secure should indeed take more responsibility here, since their software — not Ziggo's branding — is interacting at the system level. Deflecting support requests to Ziggo can leave users stuck in a loop without proper driver-level diagnostics.
What you can do (or recommend to others):
- Collect minidumps from
C:\Windows\Minidump\and analyze them with WinDbg or WhoCrashed — these often pinpoint the exact F-Secure driver causing the issue. - Report the issue directly to F-Secure via their official support, not Ziggo, and include your dump files if possible.
- Temporarily switch to Windows Defender or another lightweight AV until F-Secure acknowledges and patches the bug.
If the
C:\Windows\Minidumpfolder doesn’t exist or is empty, it usually means that Windows hasn't been saving crash dumps, possibly due to system settings or a failed write during the crash.Here’s how you can fix it and enable future BSOD logging:
✅ Enable Minidump Creation in Windows 10/11
- Open System Properties:
- Press
Windows + R, typesysdm.cpl, and hit Enter.
- Press
- Go to the "Advanced" tab → click "Settings" under Startup and Recovery.
- Under "Write debugging information", make sure:
- Selected option: Small memory dump (256 KB)
- Dump file:
%SystemRoot%\Minidump
- Ensure the checkboxes are enabled for:
- "Write an event to the system log"
- "Automatically restart"
- Click OK, then Apply, then restart your PC.
🔍 Also Check:
- That the system page file is enabled (needed for dumps).
- The crash didn't occur before Windows could write the dump (possible if the crash is immediate or hardware-related).
- Some cleanup tools (or F-Secure) may auto-delete dump files — be sure no such settings are enabled.
Once the settings are corrected and the PC experiences another BSOD, it should generate a file in
C:\Windows\Minidump\.* And make sure that you are using all the lastest windows(10/11) updates and f-secure software(25.3)
* F-Secure support should ask you for further information if necessary
-
Well, I did. First the support people dismissed the entire case, then they pretended to be stupid, then they suddenly acknowledged that the problem exists, but I still don't have a solution other than "repair your Windows files", which is not an answer.
The minidump is not created even when enabled and a page file exists — perhaps too royal of a crash. And my product is F-Secure-branded and I can predictably reproduce the crash.
-
Thanks for the clear update — and you're absolutely right to be irritated. What you're describing sounds like:
- A deep kernel-level crash (likely in F-Secure's low-level driver stack)
- A support process that's dancing around responsibility, despite a reproducible scenario
- A crash so abrupt or early in execution that minidumps never even get written, which is rare but can happen when the system crashes before Windows' dump process engages
🧨 Likely Culprit: F-Secure Kernel Driver (WFP or Wintun)
Given that:
- The crash is predictable
- Disabling/removing F-Secure immediately stops the crashes
- It's a BAD_POOL_CALLER, often related to faulty or double memory allocation
- No dump is written (suggesting it might occur in a critical path — like a filter driver)
This strongly suggests F-Secure’s kernel-mode filter or VPN driver (such as
fsatph.sys,fsni, orwintun.sys) is mishandling memory or device I/O at a privileged level.🔎 Here's What You Can Do Next:
1. Create an Event Viewer Report
Even if there's no dump, you can often get a BugCheck code + parameters from:
Event Viewer→ Windows Logs → System- Filter by Source = BugCheck or Event ID 1001
This often contains enough info to:
- See which driver caused the crash
- Provide to F-Secure as irrefutable evidence
I can help you parse that if you copy-paste the relevant entry.
2. Enable Boot Logging or Verbose Mode
You could enable boot logging to catch where the failure happens:
- Run:
bcdedit /set {current} bootlog Yes - Reboot and reproduce the crash
- Look at:
C:\Windows\ntbtlog.txt
(If the crash occurs before writing this file, it's another sign of a deep driver issue.)
- BTW.Does the BSOD crash happen even you disable the auto vpn start at startup ?
-
I don't know if it makes sense to write on the forum about the problem when the counterpart is a ChatGPT bot or uses one. If you are a real person, accept my apologies. However, the message pattern, the structure, the boldface highlights, and the apologetic introductory sentences in your messages in this thread are identical to how o4 behaves. In addition, this is a customer forum, not an arena for F-Secure's employees to do their work – at least in my narrow-minded opinion.
That having been said, I did get one memory.dmp earlier, where the faulting driver allegedly is aqnic650.sys, which is the network card's driver. The driver is not at fault because I have arrived at blaming F-Secure by changing from a Marvell-driver-driven card first to another, then to an Intel X550-T2 with Intel's drivers, and I uninstalled the Marvell drivers. When that didn't help, I tried with the integrated network card. Then my wife complained that her computer started doing the same, and that's a different computer with completely different hardware. The common denominator among those two computers is F-Secure antivirus.
By accident, I came across a bunch of network settings on my FreeBSD server (two to be more specific) which, if activated, will consistently crash both computers in this household that run F-Secure's product. And if the product has been uninstalled, there is no crash. And if I deactivate the specific network settings on the FreeBSD computer, my wife's computer won't crash, and mine will crash twice or so a week.
And the support people told me to run and collect diagnostic logs and also turn on debugging in F-Secure and reproduce the crash. They just didn't tell me where the debug log goes, if it goes anywhere. The diagnostic file I know where it is but it's irrelevant because it's collected prior to the crash.
That having been complained, answer to your question: nothing in the Event Viewer with bugcheck.
I did tell the support representative that I am willing to tell them how to induce the crash, but so far I have not gotten an indication that they want to know. Maybe they will. Maybe they won't.
-
-
Being a real person, customer and using AI as a fellow dude in contributing i hereby accept your apologie, and suggest you contact F-Secure support directly.This community's role is something else not analysing device memory dumps. Thank you
and if you have not used the f-secure uninstall tool (and reinstall software ) you should try that also(this is the usually first community advice when encountering f-secure problems like yours on windows or mac computers)
btw. Some wise man has said that only a plummer can maintain one's job description in the future almost as it is today.
