As the other posts here mention this is way too common nowadays to find on daily logs vulnerability scanners(crawlers), I recommend to set some spam traps and honeypots so you can help to catch this guys, and at the same time protect yourself using blacklists to ban them access directly from their IP on your server.
Some months ago I found my self like you, I had lots of rows on my log like the following
220.127.116.11 - - [16/Aug/2011:00:49:33 +0300] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 239 "-" "ZmEu"
The interesting issue was that all were 404 errors, first I decided to stop that adding ban to the agent ZmEu but that was not enough, searching and searching I found the Project Honeypot and found that it rocks!
I wrote some small scripts for add some well known bandits on my deny list and the rest I left it to some code provided by them you can find them on Project Honeypot.
Also you can find on the net some good php scripts to create own blacklists and some .htaccess rules to deny access to most well known bad user agents.
If you install any Application from Open source or common PHP tools like php_my_admin , blogs, or CRMS, rename all their install(remove them if possible) and administration folders to something cryptic and use .httacess to set passwords.
Another thing is that you often review your logs ban the offending IPS.
A good example and reference is found here.
Due your web Server is public you must set some access rules if you want to avoid unwanted surprises.
On my personal experience all that effort has been well worth at least site traffic from those exploiters has diminished on the last 5 months.
Also I recommend you give this article a read.