"Well, f**k."

Harsh language was appropriate under the circumstances. My router had just been hacked.

Setting up a reliable home network has always been a challenge for me. I live in a cramped three-story house, and I don't like running cables. So my router's position is determined by the fiber modem in a corner on the bottom floor. Not long after we moved in, I realized that our old Airport Extreme was not delivering much signal to the attic, where two game-obsessed occupants fought for bandwidth.

I tried all sorts of things. I extended the network. I used Ethernet-over-powerline connectors to deliver network access. I made a mystic circle and danced naked under the full moon. We lost neighbors, but we didn't gain a signal.

Eventually, I gave in to the inevitable. After some research, I purchased a router that, I was told, would probably deliver useable signal to the outer reaches of the Solar System. And it worked. The Netgear R6400 left only one place in the house with little-to-no reception. But, crucially, my wife and son were happy gamers upstairs, Netflix flixxed, and YouTube tubed. Life was sweet.

Signs of trouble: Boy stops gaming, reads a book

Then, sometime in January, I came home to find my boy, Adrian, with his face in a book. Adrian reads a lot, but there is a time and place for everything, and this was gaming time and gaming place. "How's it going, Adrian?"

"Oh, good. I gave up gaming. I kept getting kicked. Even downstairs."

I attributed that to a busy server somewhere. My connection seemed good, and no one else was complaining. A few days later, my daughter Jennifer was home from school sick. She sent me a message saying that her laptop couldn't connect to the network. I talked her through a bit of trouble shooting, and, after restarting the router, all seemed to be right again.

I was troubled, though. Adrian had basically given up on gaming, but Netflix worked, and no one else seemed to be having problems.

I looked at the router settings, and they seemed OK. The router showed no interference from competing networks, but the amount of traffic it logged was suspiciously high. Or was it? I'd never tracked my household traffic before, so I couldn't be sure that what I was looking at wasn't the normal combined Youtube and Netflix usage of five people plus regular visitors.

In fact, interpreting the data use was more difficult than it should have been. My computer was confused about how numbers should be displayed. Applications that pay proper attention to the system settings use a point as the decimal place and a comma for separating thousands, millions, etc. Applications that only pay attention to my location use a comma for a decimal point and dot to separate thousands and millions. (This discrepancy can probably be attributed to me being a New Zealander living in the Netherlands.) So either the router had logged terabytes of traffic in the last period, or it had logged almost nothing.

I knew I would have to investigate, but I travel a lot for work, so finding time was difficult.

Suddenly, connecting to the network in the attic was impossible again. I couldn't figure out why. Then I noticed that my phone was randomly connecting and disconnecting from the network. A few days later, I got a message from T-Mobile saying that I'd used all my mobile data for the month. For the remainder of the lunar cycle, I would be reduced to data delivered by drunken sloths. This had happened before, but I'd been traveling a lot then, and I had been careful when traveling ever since—the sloths had caused fellow passengers to complain. In any case, I knew it was time to pull finger and do something.

Events intervened, and I was forced to delay doing anything useful. But everyone in the house was getting increasingly frustrated with the network. Then, on my way home from work one Friday, Donna told me that absolutely nothing in the house could connect to the network, and now she couldn't do her work. Deadlines were being crossed, and it wasn't her that was going to be dead. I got the message.

I arrived home that Friday night to find a house full of disconnected family members. Then, bizarrely, upon my arrival, everything connected. I ran a speed test from my computer and Donna's phone at the same time. On average, we obtained 150 percent of our maximum-rated upload and download speed. I declared there to be no problem right now. We decided to watch a show on Netflix while I kept an eye on networking performance.

To do this, I installed Peakhour. It found the router and started displaying traffic. It didn't look like much. Netflix started streaming, which caused a small bump in traffic. But traffic swiftly flattened out to background value. As I watched an old Star Trek episode and the network traffic, I contacted the Orbiting HQ for advice on how to figure out if my router (or anything else) had been hacked.

"When the police arrest you for distributing child porn" was the helpful response.

In the meantime, the total amount of data that I'd transmitted crept up, and Netflix choked on a particularly painful Wesley Crusher moment. That's when the first useful suggestion came from the collective Ars brain: a stranger had probably managed to connect to our wi-fi.

I know our neighbors, and I didn't think that was likely. But a huge number of devices were connected to the router, so I couldn't be sure. We turned off everything that could be turned off and slept everything that could be slept. That left a couple of unknown devices, which I kicked off the network.

Nothing changed. In the first half hour or so that I'd been monitoring, I'd transmitted 25GB of data. By the time everything else had been disconnected from the router and I'd checked that the TV software was up to date, I'd logged 188GB of data (up and down combined).

Factory reset doesn't do the trick

Meanwhile, Eric Bangeman, our managing editor, had dug up an article from December disclosing a vulnerability in my router. The command that was supposed to kill the problem... didn't. Later, I discovered that if the command didn't work, you were already patched. Not only that, the only way to distribute the hack was for someone on our internal network to visit a dodgy website.

Senior Technology Editor Lee Hutchinson suggested that I install DD-WRT. A quick search of DD-WRT's online database suggested that my router wasn't supported.

Also, there had been a firmware update since the hack was reported, and I'd conscientiously installed it. An Internet search didn't provide any hint of any other problems. The collective wisdom dictated that restoring factory settings might solve the problem, and it was about the only thing I could do in any case.

Fast forward another 45 minutes. The router was reset, and the network was set up again. By the time I was done messing around, Peakhour had my traffic clocked at 470GB. But I'd gotten rid of the problem (or so I thought). The next morning, before I left for the weekend, I checked: the total traffic was at around 500GB. Maybe I'd defeated the hackers.

That night, I heard from Donna. She'd been monitoring traffic, which was now over 3TB. And, just to make sure we had no doubt, devices were dropped off the network again.

The factory reset had not worked.

When I got home, I put the Airport Express back in place. And, in the following four days, a whole 12GB of traffic was recorded. Of course, wi-fi coverage upstairs was terrible. Discontent filled the air.

I examined the router logs of the R6400 and discovered that it had been contacting an NTP server just about as fast as it could. Evidently, my router was being used to DDOS someone (sorry, whoever you are). This, as far as I can tell, has not been reported anywhere. I don't have the skills to analyze the hack properly. And, to be frank, I just wanted my router back, which I still wasn't ready to give up on.

After some searching, I discovered that the DD-WRT database isn't very good, and a firmware update was available for my router model. I downloaded it, read the instructions, and followed them. Half an hour later, I had my router back on line and was monitoring traffic: silence. When my computer was idle, the router logged almost no traffic. I kept a close eye for another 30 minutes before deciding that the router was off the botnet. I could set up my home network again.

Back to the Airport

DD-WRT is not the friendliest bit of software, but I managed to fumble my way through to get everything up and running. Except for the 5GHz radio, which remained stubbornly off. I went back to the DD-WRT stock of firmware and discovered that I could update to a new version. Unfortunately, this time I did not read the instructions as carefully...

And then I had a brick. Admittedly, it is a brick that is no longer part of a botnet, but it is also not very useful either. After more searching, I discovered that I could, apparently, fix the problem by connecting to the router through the JTAG port on the router's motherboard. By this time, though, I would have just as soon stabbed myself in the eyeball with a fork. It would save time and hurt less.

So the Airport Extreme is back in position, the R6400 is in the garage with all the other bricks, and the attic is a (nearly) wi-fi-free zone again. Next time I'll just run cable.

I admit that I'm annoyed at myself, DD-WRT, and Netgear. I could have been more careful and not ended up with a brick, DD-WRT could have a simpler upgrade procedure, and Netgear could provide a more secure router. I also discovered during this tribulation that I am not the only one who has experienced similar problems. Although there seems to be very little on the Internet, I discovered that other people in our neighborhood had had a similar experience. They, too, had been unable to remove their router from the botnet by using factory resets and manufacturer-provided firmware. They ended up replacing their routers.

Now, two experiences don't provide us with any statistics to rely on. But if my experience is common, then maybe manufacturers need to start producing a more extensive range of tools to recover hacked routers.