In that case as the FF is portable the malware may be on the USB drive, which is why it did not show on the first OTS