Two new Windows trojans pull their next commands straight from FTP server banners in a first-seen delivery trick.