the ZA firewall detects that the program is trying to connect to the web to do the usual download using javascript of some adware , trialware or even fraudware , some BS Off the web , the windows itself has both firewall and UAC permissions. the javascript portion of the install or first run of the program would be detected seperate.
If the firewall(s) block the install download be that at install or on first run, then there is not at that time the actual malware component added to the computer.