Hi beendone and welcome aboard. Firstly I think you should have posted this in a separate thread of its own. Perhaps Don can split this into 2 separate threads.
I'll try to answer your questions one by one (not necessarily in the order that you asked them).

i have a firewall and antivirus so how has he done it?
Well your firewall may be misconfigured and your antivirus may not be up to date. But what probably happened is that he wrote his own malware which is not yet identified by any antivirus and infected your computer either by social engineering (tricking you in to opening an e-mail attachment for example), or by session hijacking. He also might have a 0-day exploit for which your computer is vulnerable.

i dont know how much he can do.
He can do a lot. In fact he can do whatever he wants with your computer. In fact I'd go as far as to say that this is no longer your computer - IT'S HIS!!! He can commit any kind of cyber crime that you could imagine, from sending spam, porn (including pedophilia), threat mails, extortion, etc. he can plant as much evidence as he wants and you'd get the blame for it all. He could use your computer as a stepping stone to hack other places such as banks, government/military institutions etc. he could even make your computer into a DDoS master or zombie. I haven't even started on him stealing and using all your personal information from your computer (i.e. SSN, bank and credit details, surfing and shopping habits, reading your e-mails, etc.).  Should I carry on..... no, I think you get my point by now.

has anyone any ideas?
Yes, firstly I find it disappointing that the police don't help you. They must have some kind of cyber-crime unit to deal with things like these. Any way the absolute least you can do is a full format of all your hard disks and a fresh install of the OS from a known good source. Preferably get a brand new hard disk for your reinstall. Chances are that your computer has been root kitted too, so I wouldn't dare restore any of the data from the old install to the new one in case you reinfect it. If you want to lay charges against this guy you'll have to involve the forensics guys from the police department, which you'll have to do before doing anything else to your computer. These are the same guys that'll have to identify the malware/0-day/root kit and help you sanitize it.