Last log

[whenever]

Hi,
  Have anybody see this happpen to their lastlog before? there's no user/id 20429 on this system, tty port looks crazy, no such host(dns or /etc/host) 'ftp', date is wrong, anyone have a clue where's that from? could it be ssh1 attack?

usera    pts/0        pioneer.host.net Fri Feb  8 05:54   still logged in
20429    @**@8T*@*Z*@ ftp              Wed Dec 31 14:00   gone  - no logout
usera    ftpd24355    192.168.1.1      Mon Feb  4 07:11 - 07:12  (00:00)


Thanks