Over the past couple weeks, I've had very good results using msrpc_dcom.nasl for testing for the MS03-026 patch. Now that we have starting applying MS03-039, I'm getting inconsistent results with both the msrpc_dcom and dcom2 plugins. After applying the 039 patch, about 20% of the systems that I scan are reported as being vulnerable by both the dcom and dcom2 plugins. Microsoft's KB824146 scanner accurately reports that both patches have been installed on these same systems.
I've been updating plugins frequently today to ensure that I have the latest version. I can provide traces if needed to get to the bottom of this. TIA! John
