It may be blocking port activity, which may suspiciously look like a worm. If it doesnt have a specific name, this may be the case. (for example, if your POS software is doing an update). If that's the case, you may have to teach your a/v software that this is an acceptable activity, so it doesn't give this warning in the future. Most programs have a list of trusted programs and ports, which you can modify.
Thanks Mike, It is with a pos update and has been since a recent upgrade that it does this. I'll check the specifics the next time. It doesn't give a warning, it has the little pop up in the cornor saying it has been blocked.