I work for an anti-virus company and I'm not aware of any cases for consequential losses against anyone in the industry.
Leaving aside the fact that the EULA (license agreement) will state this very promanantly, viruses come out all the time and there's inevitably some delay between their arrival on the scene and the signatures getting onto your A/V product.
Then of course there's the issue of you proving that you used the product correctly with appropriate settings.
I'd think you'd have better luck defending the original case - after all you did not deliberatly infect his machine and took what you perceived to be reasonable actions to ensure the site's integrity.
If it's of interest what we do is have a "footbath" machine that runs scanners from ours and half a dozen other companies. Before any of our software can be released it must be scanned by this machine who's signatures are kept up to date daily