Confused: Norton Internet Worm protection's weird behavior

[cdplayer]

Quite a few times this month I have received the following message from Norton when I am downloading e-mail:

Medium Risk
Norton Internet Worm protection has detected and blocked an intrusion attempt.

Intrusion: Portscan
Intruder: 192.168.0.1(53)
Risk Level: Medium
Protocol: UDP

Attacked IP: COMPUTER NAME(192.168.0.100)
Attacked Port: 3942

I am using a D-Link Router (DI-604) - XP SP2 - Norton 2005
Six computers connected using a Peer-to-Peer network.

When I receive this message my computer is no longer able to use the Internet. The only thing that I can do is reboot.

Any comments and or suggestions are appreciated!

Thanks!!

[Greenstead]

WIth a NAT router and SPI firewall you should not see any port scans getting thru to your PCs. So I suspect Norton is incorrectly detecting a problem.

Norton make good products, but I find NIS too complex for home use with all its settings and sophistication.

[cdplayer]

Thank you Greenstead for replying!

I have discovered by reading bits of information here and there via the Internet that many individuals are having similar problems. For the past three days I have made failed attempts to contact Symantec. This is the longest I have waited for support in years.

Oh well...

[XybeX]

Few questions:

Does this occur with only one of the six computers??
Is it always the same computer?
If it is, see if youve specified this computer in advanced/DMZ settings in the webinterface of your d-link router.
Remove computer from DMZ and problem should be solved if this is a genuine attack from an external computer.
Only if youve set DMZ or a specific port forward on port 53 should anyone outside be able to penetrate your D-link from outside.

If this is not the case try to set DNS manually on your client computers.
Make sure you set the DNS settings to the ipnr of your ISP´s DNS server.
in other words do not use your D-link as DNS server so do not set DNS to 192.168.0.1.
Port 53 is for DNS requests and if Norton is falsely triggered by genuine DNS query between your client and the D-link it would be interesting to bypass your D-link and do the DNS requests directly against your ISP´s DNS server.

Check these things and see if it solves problem.