Solved Possible virus making every file read-only?

[Rhettsterhhhh]

My head has been spinning all day yesterday. Never have I had anything happen like this before. On my laptop, out of no where, my files became stuck on read-only. From program files to blank text documents, everything is write-protected. I figured my hard drive might be failing so I backed up files to another computer. Now that computer has everything as read-only! On both computers, it takes Windows Explorer 3 seconds or more to open a folder. Both computers are real slow, and I can't do anything from installing a program to deleting a empty folder! It's almost like a medical condition that spreads when copying a file from one computer to next! I believe my files are almost permently virus seeds! Afraid to do anything else after bricking two computers running Windows 7 Ultimate. First computer is an Asus Laptop (X55U). The second computer is an HP Compaq desktop (RE471AA).


Update: Avast is detecting malware. I will update this thread as both computers are running boot-time
scans.

Update 2: Avast had detected something on my backup folder on the desktop which is C:\Users\public\Rhettster. Check the image for more information.

Update 3: Avast finished on the desktop. Read-only problems still persist. I'm not sure what to do. Windows had just given me the biggest hint to what this problem is from. If you look at the pop up in the image, Windows is telling me I do not have permission from the system. I believe that the permissions are corrupted badly. Not sure how I could remove this from my files.

 

[Ztruker]

You need to work with someone at a dedicated malware removal site.

Follow directions at any of the following sites. The folks there are dedicated to malware removal and will be able to help you determine if your system is infected and if so how to clean it up. They require that you register but they are all free. Also be patient as they are usually very busy:

GeeksToGo
WhattheTech
Spyware Beware

 

[gregrocker]

Run infection scans, check System Files, establish a Clean Boot and utilize the System resources in Troubleshooting Steps for Windows 7.

If this is still the factory install then that is the worst possible install of Win7 one can have. You are long overdue for enjoying the actual Win7 OS for the first time by doing a Clean Reinstall Windows 7

 

[Rhettsterhhhh]

Run infection scans, check System Files, establish a Clean Boot and utilize the System resources in Troubleshooting Steps for Windows 7.

If this is still the factory install then that is the worst possible install of Win7 one can have. You are long overdue for enjoying the actual Win7 OS for the first time by doing a Clean Reinstall Windows 7

Avast boot time scan just stated that my Compaq desktop had grime on it. My Asus laptop has detected both viruses and grime on it. Both computer have fresh non factory versions of Windows. I will update as Avast attempts to clean both PCs.

 

[gregrocker]

Run the scanners recommended by tutorial as well. Avast is not highly recommended here any longer since it bloated up and causes issues. After the boot scan (which can't do any harm) I would uninstall Avast and try MSE for a comparison. Avast Uninstall Utility | Download aswClear for Avast Removal

 

[Rhettsterhhhh]

Run the scanners recommended by tutorial as well. Avast is not highly recommended here any longer since it bloated up and causes issues. After the boot scan (which can't do any harm) I would uninstall Avast and try MSE for a comparison. Avast Uninstall Utility | Download aswClear for Avast Removal

I have used Avast for years. Never had any bloat ware with it. I have used MSE before. It's almost like comparing Internet Explorer to Firefox.

 

[gregrocker]

We see tens of thousands of cases over the whole life of the OS here, the accumulated expertise makes this the undisputed top tech forums in web history.

Where once MSE and Avast were co-recommended, we've seen enough cases of Avast causing issues that it gradually stopped being recommended at all. I see members who still use it, but hardly any recommend it for others.

This just in: Can't reboot repair or restore aft aborted Avast uninstall Oxc 000000f - Windows 7 Help Forums

 

[Rhettsterhhhh]

We see tens of thousands of cases over the whole life of the OS here, the accumulated expertise makes this the undisputed top tech forums in web history.

Where once MSE and Avast were co-recommended, we've seen enough cases of Avast causing issues that it gradually stopped being recommended at all. I see members who still use it, but hardly any recommend it for others.

This just in: Can't reboot repair or restore aft aborted Avast uninstall Oxc 000000f - Windows 7 Help Forums

I'm now doubting this is a virus. Windows is acting like the system is in control over me. Read the latest update I made to the thread.

 

[gregrocker]

We can't see what file you were trying to open. If it's a system file then you would not have permission which has always been the case to avoid the OS being easily damaged by user access to critical files.

 

[Rhettsterhhhh]

We can't see what file you were trying to open. If it's a system file then you would not have permission which has always been the case to avoid the OS being easily damaged by user access to critical files.

Windows.old is a folder that is created when installing Windows over an existing installation. This pop up happens to almost every folder when attempting to uncheck read-only. In other words, I can't remove the read-only attributes from any folder. The system is denying me from doing so. I've used every version of Windows since Windows 98 and I have never had this happen. It's very strange. I have even used command prompt to attempt to change the permissions to no avail.

 

[gregrocker]

windows.old is a System File which can only be deleted by Disk Cleanup>System Files. So it's not a good example. But if this is happening to ordinary data files too then See if these help: All folders & subs suddenly have 'read only' attribute Solved - Windows 7 Help Forums
all files suddenly Read Only - Microsoft Community
Documents suddenly become "read-only" - Why? - Microsoft Community

 

[Rhettsterhhhh]

windows.old is a System File which can only be deleted by Disk Cleanup>System Files. So it's not a good example. But if this is happening to ordinary data files too then See if these help: All folders & subs suddenly have 'read only' attribute Solved - Windows 7 Help Forums
all files suddenly Read Only - Microsoft Community
Documents suddenly become "read-only" - Why? - Microsoft Community

This happens on every folder. Even if I create a new folder, it automatically makes the files inside read-only. No installer works, most of the time I can't delete stuff, and documents don't save. If one of the files from the infected computers makes it on a clean computer running Windows, that computer gets infected. If I reinstall Windows, I can't save my files.

 

[gregrocker]

Did you try the fix from Brink in the SevenForums thread about this issue? You didn't really have time to try anything I listed or even read the threads before replying did you?

I would also start a new thread in System Security forum here to ask for a specific solution to this possible infection based on what has been found already or scans they give you. This will help you disinfect to get either a working installation to try to restore the files from, or clean the files in quarantine enough that they can be adjusted in a new install. There is a tutorial by Brink in the first link I provided in my last post for how to change them back.

 

[Rhettsterhhhh]

Did you try the fix from Brink in the SevenForums thread about this issue? You didn't really have time to try anything I listed or even read the threads before replying did you?

I would also start a new thread in System Security forum here to ask for a specific solution to this possible infection based on what has been found already or scans they give you. This will help you disinfect to get either a working installation to try to restore the files from, or clean the files in quarantine enough that they can be adjusted in a new install. There is a tutorial by Brink in the first link I provided in my last post for how to change them back.

Sorry but I'm just frustrated. None of the solutions seem to work. I do not know what to do now.

 

[gregrocker]

I don't know what you've tried so can't advise anything else yet.

Maybe you need some time to catch up with the reading and steps.

The reality is that there is often not a fix for these things. In those cases what's best is to focus on the future by doing the best possible Clean Reinstall Windows 7 and then after it's all set up with the best tools and methods, save a backup image and file backup so that you don't end up with ruined files ever again.

However I would not dispose of the files whatever you do because there is probably a way to adjust them. I'd ask Brink in the tutorial comments once you try it and if you need more help.

 

[GeneralG]

Just saw this thread looking for information on if this is virus related & I'm curious if you've been able to solve the issue.

We just had a machine come in where I work at with a similar issue. It was saying certain software couldn't open cause of access to folder rights like one of your posts above. All the files/folders being read only was the cause.

I would recommend looking at the files you're having the issue with & seeing where they inherit their permissions from. If it's changing the perms back to read only every time you change them, you may have to go up a folder level to fix it. The C drives root folders may be set to read only, & may need to be changed so all the permissions get propogated to the subfolders & files.

 

[neddy99]

Avast is the culprit

I recently purchased Avast Internet Security.
The 'read only" problem started after the install and stopped when it was un-installed.

Avast "free" does not have this problem!

I am now in the process of trying to get my money back.

 

[GeneralG]

I would also check around on Avast's AV settings to see what in there is causing the issue. I know Avast is a pretty solid AV, so there should be something that is causing the issue in particular with your machine. What do you have in the free version vs in the paid for version that's different?

Also if you're certain about kicking Avast to the curb, Webroot is a good one we use at our customers via paid method. It is a very light weight app.
Thanks.

 

[Barman58]

I recently purchased Avast Internet Security.
The 'read only" problem started after the install and stopped when it was un-installed.

Avast "free" does not have this problem!

I am now in the process of trying to get my money back.

Does the Avast you have include Ransomware protection?

Due to the nature of Ransomware, folder protection is used by most major AntiMalware suites to prevent infection

It works by locking all data files from access by all applications, the user is should be able to whitelist the applications they use (over time as they use them). If an app that is not on the whitelist attempts to access a file the protection prevents it.

This type of system caused a lot of perceived issues such as yours recently when Anti Ransomware was added to Windows Defender (on Windows 10)

If it is this causing the issue the best cure would be to check the Avast documentation and set up your whitelist of applications ( this should include system apps such as Explorer due to the fact that the apps are digitally fingerprinted to prevent a rogue copy malware app from getting access.

If you do not feel that you need this extra protection and still want to use avast there should be a way of switching the anti-Ransomware module off

 

[neddy99]

Thanks for the replies General and the Barman. I have un-installed it. At the same time this was happening, I did a long overdue Windows Update, which failed, and I now am left without my USB keyboard and the laptop keyboard. A missing file prevents a system restore. This is being typed on the Windows virtual keyboard. DM code 19 has been fixed, but keyboard still UTS.

i won't reply anymore till the keyboard issue is resolved.

Thanks guys.