I have been having a recurring problem with a worm keeping attempting a download.

It's update.exe coming from update.mydatastatssrv.com.

It happens several times a day and Zone Alarm detects it and gets treated.

I tried to go into Advanced Setting -> Expert Rules and added a block to both the URL and IP address. With the URL/IP blocked I would assume that it would never get to the place where Zone Alarm would need to detect and treat it if the URL was blocked. The IP address seems to be the same every download. I ran into a problem before where a spam IP address was changing and even though Zone Alarm has both URL and IP address blocking it really only does IP address and the URL is useless for changing IP addresses because it looks up the URL and converts it to a static IP address. I consider this a "bug" but was told by ZA that this is a "feature". However, since the IP address is "sticking" this doesn't seem to be the issue.
Shouldn't a blocked IP/URL be rejected before ZA tries to detect a virus?
Also, the fact that I am getting multiple attempts for a download from this URL, this in itself must be a virus and why isn't ZA detecting it and getting rid of it?
Thanks in advance for any input.