Somehow the blog had been “injected” and was causing download messages with Norton. The way we found the problem was to look at the HTML sources. Buried in a link was an iframe with a call out to an external website. Nasty that. Just replacing the worpress software would not have cured the problem. They managed to get their horrible code into the content.
Sorry for any inconvenience caused.