The most important step of disinfection is the installation of security patches for the vulnerabilities exploited by Agobot.
 
Detailed information and patches are available from the following pages:
 
RPC/DCOM (MS03-026, fixed by MS03-039):
 
http://www.microsoft.com/technet/security/bulletin/MS03-039.asp
 
RPC/Locator (MS03-001):
 
http://www.microsoft.com/technet/security/bulletin/MS03-001.asp
 
WebDAV (MS03-007):
 
http://www.microsoft.com/technet/security/bulletin/MS03-007.asp
 
The neccessary patches can be downloaded from the pages above under the "Patch availability" section.
 
F-Secure Anti-Virus can detect and disable (rename or delete) Agobot backdoor files, however if a system is already infected, the special disinfection tool is required to get rid of infection.
 
F-Secure provides the special disinfection utility for all known by March 2004 versions of Agobot backdoor. You can download the disinfection tool from our ftp site:
 
ftp://ftp.f-secure.com/anti-virus/tools/f-agobot.zip
 
ftp://ftp.f-secure.com/anti-virus/tools/f-agobot.exe
 
Disinfection instructions can be found here:
 
ftp://ftp.f-secure.com/anti-virus/tools/f-agobot.txt

If you have Windows ME or XP, it is recommended to disable System  
Restore feature of these operating systems to prevent your  
computer from re-infection with Agobot backdoor-worm. The fact is  
that System Restore feature of these operating systems might save  
the infected file into the special folder and copy it back to a  
hard drive it every time it's been deleted by F-Agobot utility.  
The instructions on how to disable System Restore feature are  
here:
 
Windows ME:
http://www.europe.f-secure.com/v-descs/sfc_dis.shtml
 
Windows XP:
http://www.europe.f-secure.com/v-descs/sfc_dis1.shtml