'Last' command showing "Crash" for ftp users
 

Does anyone know why the last command shows 20 entries (randomly throughout all the logins) like this:

user ftpd24711 12.x.x.x Sun Oct 12 :21:35 - crash (10+20:16)

??

Ive never seen this before

Well beats me ,cause last shows me crashing when nothing has happened ,even when I am using the ACPI suspend it is showing crash.It is also showing crash,when
I switch runlevels and reboot.Don't know but maybe a bug?

Does anyone know why the last command shows 20 entries (randomly throughout all the logins) like this
No, I don't.

What kind of box are we talking about? Remote or local server?
What daemons are running? Wu-ftp by any chance? Updated?
Did the box crash around the time the user logged in?
Is ftpd24711 a legitimate user? A local account?
Inspected local accounts and temp dirs for anomalies?
Changes in the passwd/group/shadow files?
Bad logins reading /var/log/btmp with "lastb"? How about lastlog?
Any errors or anomalies in any of the systems logs?
Can/did you you verify integrity of the box?