Endpoint Protection Small Business Edition

We discovered a suspicious program titled IKNX.exe instantiated in the C:\Windows\Windows32\28356(?)\ subdirectory. The program created an exception in the Windows Firewall to allow it to communicate to an external address u15364142.online-server.com:Ftp-data. The program infected three of our LAN clients running End-Point Protection, two of which are POS stations. We believe IKNX was used by an attacker to compromise customer credit card data.

Has anyone had experience with this code, it is apparently undefined by Symantec. The only reference we have found is to iKNX, an open source code (OpenRemote.org) for creating GUIs for the iPhone intended to control home and office appliances, lighting, computers, etc. 

Thanks for any responses,

SRSCooks

Please submit the threat to Security Response ASAP. We need to analyze this file(s) to get this added to our definition DB.

Can I ask why you were running the Windows firewall and not the one included with SEP?

http://www.symantec.com/business/security_response/submitsamples.jsp

submit the  file to security response....call support..immediately