But as Vik pointed out, the Avast! mail and web scanners are constantly listening to the localhost ports. There is no mail or web client up in the attached picture (from Kerio) and the avast! processes are waiting for a client request on the appropriate ports. Sounds like servers for mail and web clients to me.