These items matched the port/ports that you specified:
Possible trojans are marked in red
Port
Application
Protocol
500
isakmp
tcp/udp
500
Cisco Systems
udp
501
STMF
tcp/udp
502
asa-appl-proto
tcp/udp
503
Intrinsa
tcp/udp
504
citadel
tcp/udp
505
mailbox-lm
tcp/udp
506
ohimsrv
tcp/udp
507
crs
tcp/udp
508
xvttp
tcp/udp
509
snare
tcp/udp
510
FirstClass Protocol
tcp/udp
511
Part of rootkit t0rn, a program called "leeto's socket daemon" runs at this port.
tcp
511
PassGo
tcp/udp
512
remote process execution; authentication performed using passwords and UNIX login names
tcp
512
used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine
udp
513
Grlogin
tcp
513
remote login a la telnet; automatic authentication performed based on priviledged port numbers and distributed data bases which identify "authentication domains"
tcp
513
maintains data bases showing who's logged in to machines on a local net and the load average of the machine
udp
514
RPC Backdoor
tcp
514
cmd like exec, but automatic authentication is performed as for login server
tcp
515
spooler
tcp/udp
516
videotex
tcp/udp
517
like tenex link, but across machine - unfortunately, doesn't use link protocol (this is actually just a rendezvous port from which a tcp connection is established)
tcp/udp
519
unixtime
tcp/udp
520
extended file name server
tcp
520
local routing process (on site); uses variant of Xerox NS routing information protocol - RIP