added check for wtmp begins strings