还不对，应该是这几句2009-09-30 16:38:50 10.10.1.5 POST /Template/rss.asa - 80 - 124.172.242.16 - 200 0 0
2009-09-30 16:38:50 10.10.1.5 POST /KS_Editor/fckeditor/editor/plugins/autogrow/inedx.asp - 80 - 124.172.242.16 - 200 0 0
2009-09-30 16:38:50 10.10.1.5 POST /KS_Editor/fckeditor/editor/plugins/autogrow/bottum.asp - 80 - 124.172.242.16 - 200 0 0
2009-09-30 16:38:50 10.10.1.5 POST /Space/C00N.asp - 80 - 124.172.242.16 - 404 0 2
2009-09-30 16:38:50 10.10.1.5 GET /upfiles/yingyinjiaoxue/DownUrl/200809/北京欢迎你2008北京奥运歌曲welcome.mp3 - 80 - 113.105.241.78 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 206 0 121
2009-09-30 16:38:50 10.10.1.5 POST /Admin/Skin/1/help.asp;.jpg - 80 - 124.172.242.16 - 404 0 64
2009-09-30 16:38:51 10.10.1.5 POST /Template/rss.asa nor=0&en=1&asp=0&dot=1 80 - 124.172.242.16 - 200 0 0
2009-09-30 16:38:55 10.10.1.5 POST /Template/rss.asa - 80 - 124.172.242.16 - 200 0 0

 124.172.242.16这个地址最可疑

 看了下日志，这两句可能是挂马的记录
2009-09-30 23:59:38 10.10.1.5 GET /Item/Show.asp m=1&d=7035|33|ASP_0138|嵌套的_Script_块 80 - 65.55.210.103 msnbot/1.1+(+http://search.msn.com/msnbot.htm) 500 0 0
2009-09-30 23:59:38 10.10.1.5 GET /Item/Show.asp m=1&d=7033|33|ASP_0138|嵌套的_Script_块 80 - 65.55.210.103 msnbot/1.1+(+http://search.msn.com/msnbot.htm) 500 0 0