Whenever you make a successful run on R&D, place a virus counter on medium. Etc…
The rulebook states:
After the Runner has passed all of the ice protecting the attacked server, he has one final opportunity to jack out. If he chooses to continue, the Corporation has one final opportunity to rez cards. After rezzing cards, the run is considered to be successful and the Runner accesses the Corporation’s cards by looking at them.
It sounds like a virus counter is placed on medium simultaneously as the runner accesses cards. And so, the runner gets to determine the order and can thus put a virus counter on medium before accessing R&D. Can someone confirm this is correct, or say why it's not?