You are most likely being scanned by a worm. The reason it is sparratic is because the box is being shutdown by the "shutdown -i" script that is with the worm. It is looking for ports to spread itself onto, and judging by the ports it's picking, I think it looks like sasser. Scanning them back isn't going to do anything except show in court that you went looking for holes in the attacking computer.

Just block the suckers IP at the firewall and be done with it. Trying to fight back with a worm or a middle school loser with a port scanner is pointless.

The legality of it doesn't matter, if someone wanted to bust you for hacking, they would see your nmap scans in their logs and use them against you. You shouln't use nmap outside of the network you govern, as a rule of thumb.