I have an unknown user S-1-5-32-547 and an authenticity user at each startup on the ashserv and the ashweb and ashmail. There seems to be an update issue because of this. I removed several viruses and a rootkit from my machine and this is probably a residual element but it could be a security problem which I would appreciate removing if you can tell me how.
Will this help?
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_2003_Active_Directory/Q_22394693.html
Other options you can find by googling the keyword: S-1-5-32-547