Possible false positives with NIS?

[BlackHoleSun]

Does anyone get a Bla Trojan alert while the local IP still shows 0.0.0.0? Says inbound, get them just as (before)the ISP connects.