Intruder Found With Last -ad ?

I have a question concerning information from last -ad

I find the following

gandalf pts/1 Fri Mar 23 20:08 still logged in 0.0.0.0
gandalf pts/1 Fri Mar 23 19:54 - 20:00 (00:05) 0.0.0.0
gandalf pts/1 Fri Mar 23 19:30 - 19:33 (00:02) 0.0.0.0
gandalf pts/1 Fri Mar 23 19:30 - 19:30 (00:00) 0.0.0.0
gandalf pts/1 Fri Mar 23 19:28 - 19:29 (00:01) 0.0.0.0
gandalf pts/0 Fri Mar 23 19:27 still logged in 0.0.0.0
gandalf :0 Fri Mar 23 19:27 still logged in 183.236.186.220.broad.wz.zj.dynamic.163data.com.cn

It appears that the console (:0) is logged in from some bizarre remote host. Does anyone understand why this should appear here.

Thanks,
D

Do you have VNC enabled or remote desktop? Do you have a secure password or is it any easy bruteforcable password?