Fix STATUS_PROFILING_NOT_STOPPED (0XC00000B8) error

You're working on a project in Visual Studio, running performance tests, or using a third-party profiler like Intel VTune or Windows Performance Recorder. You try to close the app or restart your machine, and suddenly you get a popup or a log entry: STATUS_PROFILING_NOT_STOPPED (0XC00000B8). The application hangs, won't close, or the reboot fails. This is a classic sign that a profiler or debugger is still attached to a process and won't let go.

What's actually happening here?

When you run a profiler (like Visual Studio Diagnostic Tools, ETW (Event Tracing for Windows), or a kernel-level profiler), it hooks into the process's execution. When you try to stop the process or shut down Windows, the operating system asks that profiler to detach cleanly. If the profiler doesn't respond—maybe it's stuck, crashed, or just slow—Windows throws this error. It's not a virus or a corrupt file. It's a coordination failure between the profiler and the OS.

The real cause is almost always one of these:

• A debugger (like WinDbg or Visual Studio) is still attached to a running process.
• An ETW tracing session is active and holding onto system resources.
• A performance monitoring tool (like Process Monitor or PerfMon) has a session open.
• A driver-level profiler (like Windows Performance Toolkit) hasn't stopped its kernel session.

Step-by-step fix

1. Close all profiler tools manually.
   Go through your open programs and close anything related to profiling or debugging. This includes Visual Studio, WinDbg, Intel VTune, AMD uProf, Windows Performance Recorder (WPR), Process Monitor, and any command-line tools like tracelog.exe or xperf.exe. If you have a command prompt running a trace, close it. After closing each one, wait 5 seconds and check if the error clears.
2. If step 1 didn't work, kill lingering processes.
   Open Task Manager (Ctrl+Shift+Esc). Go to the Details tab. Look for processes named devenv.exe (Visual Studio), wpr.exe, perfmon.exe, procexp.exe (Process Explorer), procmon.exe, or cdb.exe (kernel debugger). Right-click each one and select End task. You should see the error go away or the app close within 10 seconds.
3. If the process still won't stop, kill it from an admin command prompt.
   Press Win+X and choose Terminal (Admin) or Command Prompt (Admin). Type tasklist | findstr /i "profiler" and press Enter. If you see any results, note the PID. Then type taskkill /PID [number] /F (replace [number] with the actual PID). This force-kills the process. Repeat for any remaining profiler processes.
4. Stop active ETW tracing sessions.
   Open a command prompt as administrator. Type logman query -ets and press Enter. This lists all active Event Tracing sessions. Look for sessions named something like NT Kernel Logger, Circular Kernel Session, or any custom session you started. To stop a session, type logman stop [session name] -ets. For example: logman stop "NT Kernel Logger" -ets. Wait a few seconds and check if the error clears.
5. If you're using a kernel debugger, disconnect it.
   If you have a kernel debugger attached (commonly via WinDbg or a VM), press Ctrl+Break in the debugger window to break into the target, then type .detach or .restart. Then close the debugger. This tells Windows the debugger is done, and the error should stop.
6. Restart Windows (the right way).
   After all profiler processes and sessions are closed, try a normal restart from the Start menu. If you still get the error, do a forced restart by holding the physical power button for 10 seconds. When Windows boots back up, the error won't appear again because all profiler sessions are gone.

What to check if the error still shows up

If you've done all the steps above and the error persists, something deeper is going on. Here's what to check:

• Check for hidden drivers. Some profilers install kernel drivers that start automatically. Open Device Manager, go to View > Show hidden devices, then expand "Non-Plug and Play Drivers." Look for drivers named after your profiler (like VirtProf or IntelOverclockingProfiler). Right-click and disable them, then restart.
• Check scheduled tasks. Some profilers leave behind scheduled tasks that start tracing on boot. Open Task Scheduler and look under Microsoft > Windows > Performance or Application Experience. Disable any tasks that reference your profiler.
• Uninstall the profiler software. If you don't need it anymore, go to Settings > Apps > Installed apps, find the profiler (e.g., Visual Studio, Intel VTune, Windows Performance Toolkit), and uninstall it. Reboot. That'll remove all its hooks.

This error is annoying but not dangerous. Once you understand it's just a profiler refusing to let go, you can nuke it from orbit and get back to work.