Question about entry in auth.log

[Lisa Casey]

On Fri, 14 Nov 2008, Tom Marchand wrote:

> Or michael is vacationing in Romania.

Very odd. Sigh, Michael is not vacationing in Romania. Doubt he's ever 
been there. I got rid of the michael account (it wasn't used anyway), and 
downloaded a new copy of chkrootkit, installed it and ran it along with 
chklastlog and chkwtmp. Nothing was found. Pehaps this was a harmless 
enough prank? Anything else I ought to look at? Fortunately the michael 
account did not have te ability to su to root.

Lisa