The Moon Worm - Infects Home Routers - Shows Fake "Adobe Flash Critical Update Required" Message

Question

Greetings,
This morning we had numerous workstations pop up with an Adobe Flash error.  The browser will be taken over by an Adobe Flash Critical Update Required page and won't let the browser go to any other internet site.  Within the page, a box will pop up that says:  "Attention!  your current version of Adobe Flash Player is outdated!  Your computer is vulnerable to malware now.  Update your Adobe Flash player now."
This message pops up on IE Explorer version 9-11, Google Chrome and Firefox and the operating systems are Windows XP Pro and Windows 7 pro.  It has all the behavior of a virus or malware so I don't want to run it's download file which is named install_flashplayer_12_x32_64_msaa_aax_latest.exe.
I've been able to download both flash player installs from the Adobe.com site for both IE and Other Browsers.  Sometimes I've been able to run the installs and it shows that the download and install ran okay with Adobe Flash Player 12 ActiveX showing up in the installed programs list.  Other times, the install won't run and the install file mysteriously gets deleted.  Even after the successful download and install, the browser works briefly okay and then gets seized by the "Critical Update Required" page again.
We're running AVG Anti-Virus Business Edition which is kept updated.  A scan with this program and an updated version of Malwarebytes isn't showing any viruses or malware that could cause this problem.
What can I do to get rid of this "Critical Update Required" problem and get our browsers working again?
Thanks.
Bill J., Lexington, KY

Answer 1

I have a Cisco E3000 Wireless N Router. I was having the issue accross OSX and Windows. This thread was a big help, but when I tried to get the latest firmware from Cisco I found the download link was no lnger present. I chatted with their support and obtained the following info if it helps anyone:
"Linksys is aware of the malware called “The Moon” that has affected select older Linksys E-Series routers and select older Wireless-N access points and routers. The exploit to bypass the admin authentication used by the worm only works when the Remote Management Access feature is enabled. Linksys ships these products with the Remote Management Access feature turned off by default."
" If you have not enabled the Remote Management Access feature of the router, you are not susceptible to this specific malware. If you have enabled the Remote Management Access feature, we can prevent further vulnerability to your network by disabling the Remote Management Access feature and rebooting your router to remove the installed malware. Linksys will be working on the affected products with a firmware fix that is planned to be posted on our website in the coming weeks."
"What we can do to fix this issue is to make sure that the router's security settings is enabled and the remote management is disabled."
"Ensure that the Filter Anonymous Internet Requests on the Security Page is enabled."
"The next step would disconnect us from the session. We need to reboot the router to clear the cache."
"According to the system, your product is already outside the complimentary assisted support period. I’d just like to inform you that we normally charge a fee for supporting this type of issue,
but since we’re seeing a potential hardware problem with the product, we’ll be extending complimentary support just this one time."
"We also need to upgrade the Firmware. However, the Firmware for this router is no longer available for download. Disabling the remote management on your router and securing it would help fix the issue."
I did find the latest firmware for the E3000 here: http://www.userdrivers.com/LAN-Network-Adapter/Linksys-E3000-Wireless-N-Router-Firmware-Up date-1-0-04-build-6/download/