25 or 110? The first is usually for smtp (outbound mail) and the second for pop (inbound mail). You can see the links on my signature to found TCPView and see which application is using that ports… I bet on a spam killer at 110 8)