Question about entry in auth.log

[Wojciech Puchar]

> Very odd. Sigh, Michael is not vacationing in Romania. Doubt he's ever been 
> there. I got rid of the michael account (it wasn't used anyway), and 
> downloaded a new copy of chkrootkit, installed it and ran it along with 
> chklastlog and chkwtmp. Nothing was found. Pehaps this was a harmless enough 
> prank? Anything else I ought to look at? Fortunately the michael account did 
> not have te ability to su to root.
it doesn't matter if he/she had, if he/she don't know root password.