Use a FTP program, for most you right click on the directory, hit properties, and there should be a field to fill in the CHMOD

If you view the source and can find the location of the file on the server, and that folder that the file is in isn't protected, then yes they can download it.

__________________

Register/Login Script
Do you use a Password Protected Directory? Need a way to allow users to make their own account, try my .htaccess Login Script