Ah, I see the problem. Yes the grey line that contains the long browser string in live traffic is the actual user-agent string that identifies the browser and THAT is what you must use for blocking. So if you want to block:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:22.0) Gecko/20100101 Firefox/22.0
For example, you can use:
*Macintosh*
or *Gecko*
Which will block anything containing Macintosh or anything containing Gecko, but it will block a lot of other browsers too that contain those words. So if you just want to block one specific culprit just put the whole browser string in there without any asterisks.
But always use the grey browser string, not the text next to "Browser:".
Regards,
Mark.