The firewall is ZoneAlarm. Please let me know if I can be of any further help. The scan was done using tcp with both SYN and FIN set to try to hide the scan. Here's a switch, Chris submitting something. Decided to pour through my logs to see if I could correlate some of Matt's findings.
Results are kind of interesting.
I would be curious to see if we have any source matches just to get an idea how long this thing may have been out there. I read about the Lion worm and checked the logs of the three linux machines we run. This originates in Chile which is why I mention it since I saw reference a to Brazil on your Detects Analyzed page for today. We also don't run dns, so there is little chance of any entry through there. Hope this mildly meaningful.