Remove the "String Match" value "virus.found" and untick "only Use RegEx for parsing only".
I'm not sure whether the "String Match" will support regex like in your example for "virus.found" so just try without it.
Everything else seems perfect.
Anyway let's see what the rest of the guys will say as i've never used string match
P.S: from what i see you are up to speed already