A Zorin PC in a home full of Windows machines sits in an odd position: immune itself, but able to carry infections for others. This page covers the carrier problem honestly and fixes it with one free tool.
Imagine your Zorin PC holds the family photo archive, shared with two Windows laptops. A bad file lands in that share from a laptop. On your Zorin machine it does nothing — wrong format, cannot run. But the day someone opens it on a Windows PC, it runs there. Your PC was never the victim; it was the carrier. There is a second danger in the other direction: if an infected Windows PC can write to your shared folder, it can encrypt the shared files from its side. Both problems are real, both are fixable, and neither needs panic — just a scanner and sensible share settings.
Immune and carrier are not opposites. A Linux PC can be both at once — untouched itself, yet holding files that would harm a Windows machine.
A file sitting on a disk is just data. It harms nobody until a system that understands it executes it. That is why your Zorin PC can store a Windows virus for months with zero effect on itself — and why copying that file onward can still cause damage elsewhere. Offices learned this long ago with Linux file servers, and the standard answer is unchanged: whoever stores files for mixed systems should scan them. It is good manners and good security — your clean system becomes a checkpoint that protects the vulnerable ones.
ClamAV is the long-standing free and open-source antivirus engine, and catching Windows malware sitting on Linux storage is its most common job worldwide. Install it and its friendly front-end from the terminal with sudo apt install clamav clamtk, then update the definitions with sudo freshclam. ClamTK gives you a simple window: choose your shared folder, run a scan, and let it quarantine anything it recognises. You are not scanning because Zorin is at risk — you are scanning so that nothing dangerous sleeps in your shares waiting for a Windows victim.
Point the scanner at the folders you actually share — for example clamscan -r /home/yourname/Shared scans that folder and everything inside it. Run a scan after any big file transfer from a Windows machine, and schedule a weekly one in ClamTK if your shares are busy. Two honest limits: ClamAV's detection is good but not perfect, and a brand-new threat may not be in its definitions yet. Scanning lowers the risk greatly; it does not certify a file as guaranteed clean. Windows PCs should keep their own Defender switched on regardless — your scan is a second lock, not their only one.
The quieter danger runs the other way. If a Windows PC on your network gets infected with ransomware, it will encrypt every file it can write to — including your shared folders, working from the Windows side. Your Zorin system stays healthy while the shared copies are locked. Defences are simple: give read-only access wherever people only need to look, use a password on shares instead of open guest access, and keep your real backup on a drive that is not shared at all and stays disconnected. Ransomware can only encrypt what the infected machine can reach and change — so decide, deliberately, what that is.
Watch the video for Zorin's own protection test — then apply this page to the folders your family actually shares.
▶️ Watch Full VideoNo. Storing is not running. The file cannot execute on Linux, so your system stays unaffected no matter how long the file sits there. The risk is purely to Windows machines that later open the file — which is exactly why scanning shared storage with ClamAV is worthwhile.
Scan after any large transfer from a Windows PC, and weekly if the shares change often. Also scan a folder before copying its contents onto a Windows machine that matters — a school or office laptop, for example. Each scan takes minutes and uses the free ClamAV definitions, updated with sudo freshclam.
Your Zorin system's own files are safe — the infection cannot run on Linux. Files inside folders that the infected Windows PC could write to are not safe, because the encryption happens from the Windows side. Read-only sharing, share passwords and a backup kept outside all shares are the protections that matter here.