Non system files (data files I've created ) appear now with the system attribute set. preventing deletion, move or rename.

Clear the System attribute only within the affected data folders, then use Process Monitor to identify the program responsible if the attribute is applied again.

1. Inspect and clear the attribute

1. Open Command Prompt. Use Run as administrator only if the affected folder requires elevation.
2. Inspect one affected file:

attrib "C:\Users\YourName\Documents\Example.docx"

An S in the output means that the System attribute is set.

3. Clear it from that file:

attrib -s "C:\Users\YourName\Documents\Example.docx"

4. For a folder containing only personal data, clear it recursively from the folder, its files, and its subfolders:

attrib -s "C:\Users\YourName\Documents\*" /s /d

Replace the path with the actual affected data folder. The -s option clears the System attribute, /s includes matching files in subfolders, and /d also processes directories.^1^

Do not run this against C:\, C:\Windows, Program Files, or another folder containing genuine operating-system files. Start with one affected personal-data folder and confirm that its files can then be moved, renamed, and deleted.

If files also have unwanted Hidden or Read-only attributes, first inspect them with attrib. Clear those attributes only if they are incorrect:

attrib -s -h -r "C:\Users\YourName\Documents\*" /s /d

Windows documents -h and -s as the method for clearing hidden and system attributes before removing affected files or directories.^2^

2. Determine whether something is setting the attribute again

A sudden bulk change across unrelated Word, Excel, and audio files suggests that the responsible process should be identified rather than repeatedly clearing attributes.

Use Process Monitor:

1. Start Process Monitor as administrator.
2. Press Ctrl+L to open its filter.
3. Add a filter such as:
   • Path → begins with → the affected folder path → Include
4. Clear the existing events with Ctrl+X.
5. Create a test file in that folder and wait for its attribute to change.
6. Stop capture with Ctrl+E.
7. Examine events for the test file, particularly operations that change basic file information. Check the Process Name, Image Path, Command Line, and event properties.

Process Monitor captures real-time file-system activity, process details, operation parameters, and thread stacks, allowing the process making the change to be identified.^3^

If the process belongs to backup, synchronization, file-management, or security software, update or disable that software’s relevant feature before clearing the attributes again. Do not disable an unfamiliar process until its executable and publisher have been identified.

3. Check for unwanted software

Because the changes appeared unexpectedly and affect many unrelated files, save open work and run:

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now

The computer restarts and scans without loading normal Windows, making it harder for persistent malware to hide.^4^

4. If attributes stay cleared but operations remain denied

That indicates a different issue, such as permissions, an open file, or file-system damage—not merely the System attribute.

For suspected disk errors, open Command Prompt as administrator and first run a non-repairing check:

chkdsk C:

Use the actual affected local drive letter. If errors are reported, back up important data before scheduling a repair with chkdsk C: /f. CHKDSK checks file-system metadata; /f repairs detected errors and may require a restart when the volume is in use.^5^

References

1. attrib
2. rmdir
3. Process Monitor v4.13
4. Virus and Threat Protection in the Windows Security App | Microsoft Support
5. chkdsk