Wow, this seems to be a big problem many users have reported! See if this KB article helps: You cannot view or change the Read-only or the System attributes of folders in Windows Server 2003, in Windows XP, in Windows Vista or in Windows 7
Try downloading ProcessMonitor from sysinternals and add a filter with the
SetBasicInformationFile. From there you should at least be able to see who is modifying the files.
To set a filter (I think it pops up to start with) click on the funnel in the menu. Then choose:
Operation is SetBasicInformationFile Include
Then click the Add
If you cannot download it to the infected computer, place it on a flash memory or equal and run it from there.