ok well there are basic options i'll play with scanning a usb stick & post back
first got a test virus and put it onto a 4gig usb stick
https://www.ikarussecurity.com/wp-content/downloads/eicar_com.zip
usb stick was founf to be mounted at : /run/media/andrew/9EA0-E584/
so i ran : bash-5.0# clamscan -v /run/media/andrew/9EA0-E584/
// -v is verbose mode see below
Scanning /run/media/andrew/9EA0-E584/eicar_com.zip
/run/media/andrew/9EA0-E584/eicar_com.zip: Eicar-Test-Signature FOUND
Scanning /run/media/andrew/9EA0-E584/eicar.com
/run/media/andrew/9EA0-E584/eicar.com: Eicar-Test-Signature FOUND
----------- SCAN SUMMARY -----------
Known viruses: 6744204
Engine version: 0.101.4
Scanned directories: 1
Scanned files: 8
Infected files: 2
Data scanned: 8.82 MB
Data read: 32.29 MB (ratio 0.27:1)
Time: 153.499 sec (2 m 33 s)
bash-5.0#
it told me it found two infected files plus everything it scanned; to see only infected files use -i flag
eg
bash-5.0# clamscan -i /run/media/andrew/9EA0-E584/
LibClamAV Warning: **************************************************
LibClamAV Warning: *** The virus database is older than 7 days! ***
LibClamAV Warning: *** Please update it as soon as possible. ***
LibClamAV Warning: **************************************************
/run/media/andrew/9EA0-E584/eicar_com.zip: Eicar-Test-Signature FOUND
/run/media/andrew/9EA0-E584/eicar.com: Eicar-Test-Signature FOUND
after getting info you can just manually check the suspected file. next i'm going to :
# clamscan -i --remove=yes /run/media/andrew/9EA0-E584/
yep that got rid of the test virus.
bash-5.0# clamscan -i --remove=yes /run/media/andrew/9EA0-E584/
LibClamAV Warning: **************************************************
LibClamAV Warning: *** The virus database is older than 7 days! ***
LibClamAV Warning: *** Please update it as soon as possible. ***
LibClamAV Warning: **************************************************
/run/media/andrew/9EA0-E584/eicar_com.zip: Eicar-Test-Signature FOUND
/run/media/andrew/9EA0-E584/eicar_com.zip: Removed.
/run/media/andrew/9EA0-E584/eicar.com: Eicar-Test-Signature FOUND
/run/media/andrew/9EA0-E584/eicar.com: Removed.
----------- SCAN SUMMARY -----------
Known viruses: 6744204
Engine version: 0.101.4
Scanned directories: 1
Scanned files: 3
Infected files: 2
Data scanned: 0.12 MB
Data read: 0.10 MB (ratio 1.24:1)
Time: 157.058 sec (2 m 37 s)
bash-5.0#
if
your scanning your system maybe use -i flag to get info then go and check out
suspected, maybe using find / locate to get exactly where it is.