Hi everyone,
Sorry if this is not the good forum to post. I don't know exactly how to describe the problem. Please move my topic if needed.

I have been using Zone Alarm free firewall for several years now and I'm happy with it.
But I looked by chance at my logs recently to find out that there have been strange recurring blocked connexions on my computer and network since february: successive high port numbers, and routed through my current pc to another pc on my local network.

FWROUTE,2010/03/09,10:34:44 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/09,11:14:28 +1:00 GMT,,,TCP (flags:AP)
FWIN,2010/03/09,17:30:42 +1:00 GMT,,,UDP
ZLUpdate,2010/03/09,18:00:12 +1:00 GMT,,,Auto
ZLUpdate,2010/03/09,18:00:16 +1:00 GMT,,,Auto
FWROUTE,2010/03/09,18:46:08 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/09,18:48:50 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/09,18:50:06 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/09,18:51:14 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/09,19:53:38 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/09,19:57:10 +1:00 GMT,,,TCP (flags:AF)
ZLUpdate,2010/03/09,20:23:56 +1:00 GMT,,,Auto
ZLUpdate,2010/03/09,20:23:58 +1:00 GMT,,,Auto
FWROUTE,2010/03/10,09:19:14 +1:00 GMT,,,UDP
FWROUTE,2010/03/10,10:01:50 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,10:03:14 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,10:12:14 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,12:37:54 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,12:40:08 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,13:02:30 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,13:09:10 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,13:38:04 +1:00 GMT,,,TCP (flags:AF)
ZLUpdate,2010/03/10,14:23:48 +1:00 GMT,,,Auto
ZLUpdate,2010/03/10,14:23:52 +1:00 GMT,,,Auto
FWROUTE,2010/03/10,15:07:58 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,16:06:46 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,16:41:26 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,16:42:54 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,21:27:34 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/10,22:43:16 +1:00 GMT,,,TCP (flags:AR)
FWROUTE,2010/03/11,11:41:10 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,11:43:38 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,11:52:36 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,12:12:26 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,12:15:26 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,12:55:52 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,16:41:42 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,16:42:56 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,16:43:30 +1:00 GMT,,,TCP (flags:AF)
FWROUTE,2010/03/11,17:21:00 +1:00 GMT,,,TCP (flags:AF)

Can a normal program do this?

I fear this is an attack but I didn't find any malware with my avira antivir and a Hijackthis scan.