Sorry for the slew of questions lately, Im just trying to get some security on my box....

So when running chkrootkit I get the error...
Checking `z2'... user root deleted or never loged from lastlog!

so I manually run lastlog and sure enough....
Username Port From Latest
root **Never logged in**

I have read that some other users have had this problem but they never logged in as root, only su (heck, I thought it was the same thing). I too have never actually logged in as root.

I log in via SSH, su root and run lastlog again, it still says root has never logged in.... OKAY now Im worried... and before I go nuke my hole box, Im curious if there is any other tips or tricks I should try before wiping everything clean?

Log in as root from a console (not a terminal window), it should show up then. Using su is not the same as logging in as root at a console.

That was it!
Youre a life saver... thank you very much!