Avast prevent setting RO attribute on "Program Files" folder.

[l.grenet]

Hi,

My environment : Win 7 Pro 64 bits / Avast free latest rev.

For any (unknown) reason, "Windows update" removes sometimes (not every times) the ReadOnly attribute on "Program Files" folder. As a result, this folder is no more displayed in Explorer with its localized name (Programmes, if your Windows is in French), but on its actual name ("Program Files"). I specify it is a standard feature of windows to apply localized names, defined thanks to desktop.ini file, only if the corresponding folder has its RO attribute set.

The issue is that.... Avast prevents setting again this attribute.
If in a Shell command window, open with administrator priviledges, the command attrib +R "C:\Program Files" is typed, nothing happens, no error message, but the attribute is not set....

Some tests run on virtual machines showed me that it was Avast which was the cause.
The only solution is then
- to de-install completely Avast
- pass the command to set "Program Files" folder RO
- then re-install Avast, and restore its parameters saved before step 1
I works, I already did it... but it's not very easy....

So if someone from Avast team reads this post, please do something to allow users to restore the RO attribute on "Program Files" folder when it has been removed by Windows Update....

[Leah96xxx]

Avast should not be preventing you from setting "read-only" attributes on any folder. And Windows update should not disable this attribute, in fact Windows Update should be setting it to read only since it is a system folder.

The most likely reason that you cannot manually enable it is because, by default, Program Files is "owned" by the system in the permissions properties. Since this is an issue with Windows it would probably be best to post this issue on the Microsoft Community instead of here but I will try to help you anyway.

Since I use Windows in English I can only provide assistance in English, though I'm sure most of the items on French Windows should be similar translations, or even in English as well.

To check folder permissions open the folder properties, click the "Security" tab, and click "Advanced" (not "Edit").

The permissions list should look like this:
TrustedInstaller - Full control - This folder and subfolders
SYSTEM - Modify - This folder only
SYSTEM - Full control - Subfolders and files only
Administrators - Modify - This folder only
Administrators - Full control - Subfolders and files only
Users - Read & execute - This folder, subfolders and files
CREATOR OWNER - Full control - Subfolders and files only
ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files
ALL RESTRICTED APP PACKAGES - Read & execute - This folder, subfolders and files

None of the principals should have "inherited" permissions. If any of these permissions are different to what I have listed then there is a chance they may have been changed by malware.

Have you run a full system scan with Avast to check for malware? Before running the scan, make sure that all scan areas are selected in the scan settings. This may make the scan take longer but it will give a much more thorough scan.

Also, did you install any software before the issue first occurred?

[l.grenet]

Thank you for all your should... but what I describe is not an hypothesis, but a fact !

WU should not disable this attribute, but actually, just before WU attribute was set, and just after it was no more....
Avast should not be preventing you from setting "read-only" attributes on any folder, but actually, with Avast set (and even with all its agents deactivated) it is impossible to set the folder RO, and after de-installing it (and doing nothing else) it becomes possible. This is not speculation or hypothesis, I did it.

Moreover, all of this has been reproduced on VM (with Virtualbox) with fresh install of Win7 and Avast.
And thank you for your remaks around Access rights and other full scan. I wouldn't have write this post before checking all of that...

So, OK, it should not be like this, but it is.

What Avast could do to avoid it would be a more interresting question...

[Rundvleeskroket]

Can't you disable Avast for a moment, and/or disable Avast Self Defense if needed, and then set the folder properties?

[l.grenet]

As mentioned in my initial post, even with Avast disabled, setting attribute fails.

And to be 100% sure of my asumptions, I just ran a new test.

On VirtualBox, I open a fresh install of Win 7 (and nothing else)

On this environment, by default, "C:\Program Files" has RO attribute set.
From a shell window (open with admin rights) I'm able to
- remove it (attrib -R "C:\Program Files") : Attribute is removed
- set it again (attrib +R "C:\Program Files") : Attribute is set

On this environment plus Avast (and only Avast, nothing else)
I'm still able to remove RO attribute, but I'm no more able to set it again ! Command attrib +R "C:\Program Files" do not generate any error message, but attribute is not set !

On this latest environment, I only de-install Avast (and nothing else)
As a result, I'm now able again to set RO attribute !
Clearly, it is Avast that prevented me to set the RO attribute.

So, I agree with LeahG, Avast should not prevent me from setting RO attribute, but actually, it does....

[l.grenet]

... and/or disable Avast Self Defense if needed ...

Thanks a lot, Rundvleeskroket !

Actually, even if disabling Avast agents were not enough, disabling Avast Self defense works ! It becomes feasible to set RO attribute.

Avast team : I guess you now have enough information to solve this issue. Please go 

[Rundvleeskroket]

As mentioned in my initial post, even with Avast disabled, setting attribute fails.

I've reread your initial post several times but you did not mention that. Only that uninstalling Avast worked.

I've just tried it in my Win7 VM with Avast Free and I can't even get the Program Files folder to unset the RO-flag. Not via explorer and not via admin shell.

[Rundvleeskroket]

... and/or disable Avast Self Defense if needed ...

Thanks a lot, Rundvleeskroket !

Actually, even if disabling Avast agents were not enough, disabling Avast Self defense works ! It becomes feasible to set RO attribute.

Avast team : I guess you now have enough information to solve this issue. Please go 

Glad it worked for you

[l.grenet]

I've reread your initial post several times but you did not mention that.

You're right. Sorry for that 
I was convinced I wrote that.... but actually, I re-read it also, and it was not in initial post but in my answer to LeahG. 

But the most important is that your suggestion do deactivate self defense was succesful !
Thanks again for that

[Rundvleeskroket]

You're welcome.