ClamAV configuration files are in /etc/clamav. You probably won’t have to change them. Logfiles are in /var/log/clamav, but they track program operation, not infected viruses found when scanning. The clamscan command lines given here also include a switch to output logging lists of infected viruses.
The little-known Debian "volatile" library is where Debian keeps things like database updates for anti-malware software databases (e.g. ClamAV and spamassassin) and other things that need to be constantly updated (e.g., tzdata) without going through the customary software review process.
Volatile-sloppy is only for people who know exactly what they are doing; automatic updates from there may fry programs you depend on.