Mutt did you press your ZA "More info" button at the time? Thisll take you to the ZA web-site where a detailed explaination of the current alarm can be found. 9 times out of 10 it provides a satisfactory answer. If youve alowed logging, your ZA alert-log file should still have the details.
ZA is a firewall to protect against outside intrusion into your computer whereas NAV is a virus detector\hunter\killer. Id say your attachment contained a web-link of an intrusive nature that your trustey ZA intercepted as soon as the link activated.