Your second screenshot shows a possible path for khmer.exe. Have you found this .exe yet ? If you haven't, I suggest browsing dirs near this one ; the ioFTPD.exe might be there.
The most interesting file for us is "ioFTPD.exe" because it is watermarked and can help us to find who put it on your server.
I hope you'll be able to clean your server soon ; good luck
