An Error event that is related to the System Restore filter is added to the Windows XP System log if you repeatedly restart the computer

If you repeatedly restart the Windows XP-based computer, the following Error event entry may be added to the System log:

Event Type: Error
Event Source: sr
Event ID: 1
Description:
The System Restore filter encountered the unexpected error '0xC0000035' while processing the file file name on the volume volume name. It has stopped monitoring the volume.
Data:
0000: 00000006 004e0004 00000000 c0000001
0010: 00000000 00000000 00000000 00000000
0020: 00000000 00000000

This issue occurs because System Restore cannot successfully rename the Change.log file. System Restore tracks activities on the volume. System Restore logs those activities in the Change.log file. The Change.log file is created in every restore point folder. When the Windows XP-based computer restarts, the Change.log file is renamed to Change.log.number, where number is the next free number up to 1,000. However, if number reaches 1,000, System Restore cannot successfully rename the Change.log file. If System Restore cannot successfully rename the Change.log file, System Restore stops logging activities.

Warning If you use the following workaround and turn off System Restore, all existing restore points are removed. Additionally, you cannot track or undo changes that have been made to the computer.

To work around this issue, turn off System Restore, and then turn on System Restore. For more information about how to turn on and turn off System Restore in Windows XP, click the following article number to view the article in the Microsoft Knowledge Base: