inbound traffic? are you on a fixed IP (or atleast a semi fixed)
I am assuming that Kerio blocked the traffic
How persistant are the incidents, are these hammering at the door, or just passing bell ringers.. what I am asking is there a pattern ie port 1234, 129, 11234 14789 33000 etc and repeating from the one IP.. some one hammering at the door.. the one to look i nto..
or a scann from one ip, then another IP from random domains,but similar ports.. the passing doorbell ringer, worm activity.. some worms do scan various ports and a few firewalls will report them as the various trojans ..

Neg is it possable to export the Log to a txt file, or just brows to the Prog file dir and open in notebook..

**** wher have I got a machine with Kerio on it,..

Cheers