Security issues

[motaaa]

Questions:
1.) If someone has my SQL database, would it be possible for him to tweak it in any way to record passwords on login or anything like that. Anyway at all for them to actually "key log" or anything else malicious through altering SQL code?
2.) Someone has my FTP, he installs an exploit, I remove it. I installed a completely fresh version of vBulletin, is there anything else that he could have done to "key log" or anything else malicious through my website? **Pretty much reword of #1
3.) I have a Netgear router (kind of old) with no password protection. Does this make it easier for him to sniff my network? Can he use this to keylog me for any passwords, I know it's possible for him to log unencrypted message packets sent such as AIM but that's not what I'm worried about.
4.) Is there any way I can limit the IP that can log into my website to ONLY my IP or a small IP range around my house? Would this fully prevent anyone else from logging in knowing that I have no VPN installed on my computer.
5.) Are there any suggestions anyone can give me to how this person is doing this? I know exactly who it is, which is the sad part. He's an idiot and he's only 15 or 16 if I remember right, but he does have connections with some very notorious underground hackers from what I hear.
6.) Are there any ways I can manually check for a keylogger that my virus scanner wouldn't pick up? I need any help at ALL anyone can provide me with. Thanks!

Story of my security issues if you want to read
I had my website broken into originally 3 months ago or so and it happened ALL the time for 60 days until I could switch hosts. I found it the reason is because I run a business and a rival companies employee worked at my hosting company and was abusing his power, it was a horrible company with no encryption on the passes or anything. He completely destroyed everything very frequently and I always had to fix stuff up.

Once I switched I never noticed anything weird. However, the other business owner began laughing at me in a message he sent to me (he's extremely unprofessional, a child even) about how he has my current SQL. I told him he may have my old one when I had the bad hosting company but theres no way for him to get it now. Regardless, what is he going to do with a double MD-5 Hashed password with salt?

But more recently I noticed on my forums that many of these posts (and even PM's) had been marked read when I had never seen them. On top of that I had reports of people telling me that I was giving them certain messages on their AIM screen names when I had absolutely never sent those messages. I did a complete virus scan and got 3 reported viruses (2 of which contained possible keyloggers).

The link that the antivirus linked me to so I could view details on the virus was in the "/advisories" directory of the website, so I'm not sure if that means they were just advisories or not. Regardless, the antivirus auto removed them and would not even give me the option of restoring them because of the seriousness of the threat. After that I changed my passwords for everything and then set the option in AdminCP to record IP addresses on the "Who's online?" updates sent every minute so that I could view who's on my account since they weren't making any posts.

When I had gotten hacked originally on my bad host, it was through a proxy based in Atlanta, GA through the FDC-Servers network. He abused his power as a member of my hosting companies team to install an exploit on my server and then used it to delete everything and edit my front page on the exploit, which he logged on to through that proxy in Atlanta. Well since I ran the virus scanner and changed passwords, I got a new IP login to my account that's based in Atlanta, GA.

I also have an automatic live proxy IP rerouter to give me their regular IP so it's not through the proxy this time. However, it's still a BellSouth IP with a range of 74.160.0.0 through 74.191.255.255 so it's not exactly narrowed down too much. I really don't want to get involved in an FBI investigation, but if this happens anymore then they will be called. I actually called them before in Atlanta and they told me I had a case but I would need to call the ones in my area, and I just decided against it after thinking it over. So I want to do EVERYTHING in my power to fully prevent this so I won't have to get involved with the FBI.

Note that I have a Netgear router with no password required to login, I don't know if that means he can sniff my router a whole lot easier or not. I really have no idea how he's getting my passes constantly, read my questions at the top of this post.

[Dismounted]

1. If he has your database - that's all he has. Nothing more, nothing less.
2. No, unless he has multiple copies stored on your server.
3. You do know how hard it is to sniff someone's packets, right?
4. If you have a dynamic IP, no. But if your IP is static, yes.
5. Errrr, you already said you knew, didn't you?
6. Get another virus scanner? In any case, you won't get a virus if you're careful what you're doing online.

[motaaa]

Yes, I know who it i but it's not like he lives down the street so I can beat some sense into him. He lives several statelines away from me. Man all I know is I ran this virus scanner and it said it removed 3 viruses (2 of which are possible keyloggers) and I changed all my passes and he got right back in less than a day later.

I'm on GoDaddy so I can't imagine he hacked that, my password is impossible to crack at this point without running a brute force for longer than the universe has existed unless you get really lucky. I guess more than anything it's just bugging the hell out of me HOW this guy can do this to me?!?!

Also, sniffing packets is not hard - well it's incredibly easy coming from your network anyway. I don't know too much about connecting to other peoples networks and sniffing from there as I've never needed to, but if all they have to do is set an IP (and he has mine from working at my old hosting company) then it's a cakewalk. Tons and tons of message packets are sent unencrypted, but I'm not sure of any passwords (though I am most likely wrong) that are sent plain text.

[snakes1100]

If your the only one that logs into the server via ssh or ftp or thru a host panel, then you can simply block all access to those ports and lock them down to your IP, simply host.deny them or set up some rules via iptables.

If this is still going on after all this time, it may be time for you to wipe and redo your OS on your puter as well, if there is still and exploit in your system, he very may well be using your own puter to do the accessing of your server.

[motaaa]

I've gotten the top antivirus, top spyware scanner, top registry cleaner, top internet security, as well as bonuses like the top rootkit scanner (with VERY DEEP scans), something that checks DLL's attached to your running exe's, and several more things. I'm installing SP3 from Microsoft right now (I had SP1) and doing tons of other stuff. I changed all of my passwords on a different computer on a different IP on a school computer and I'm not logging in any of my accounts until I finish this deep scan.

The problem with reinstalling Windows is that I run a business and all of my private source codes (I sell C++ coded programs) are stored on my computer and I have been so scared of this hacking issue that I haven't felt safe putting ANY of my sources on to a remote server anywhere. My CD-Burner is broken and it's far too big for floppy drives (which is also broken, but I can get an external floppy drive.) I am just looking to fully fix this problem but the thing is I have absolutely NO idea how they're doing this.

I was coming up with some ideas on how they could have done this through the information they had as my previous host owners from before that I wanted to run past you.
-Could they possibly put something in the SQL to forward all SQL entries to another remote SQL?
-Could they have passwords sent to a remote SQL in plain text BEFORE md5(hash($hash+salt)) encryption is placed on the text strings?
-Any other possibilities?