Yup, the IIS log from an NT server 4.0 server. Multiple entries from ONE infected server that was exploited by Nimda.