Can you be more specific?
It may be blocking port activity, which may suspiciously look like a worm. If it doesnt have a specific name, this may be the case. (for example, if your POS software is doing an update). If that's the case, you may have to teach your a/v software that this is an acceptable activity, so it doesn't give this warning in the future. Most programs have a list of trusted programs and ports, which you can modify.
Mike