several options you have done eg ZA, cool,
block non internet proggs from accessing the net.
if you are not using the ftp service , simply disable it.
login as admin ,in the start\run box, type services.msc
find telnet service , right click properties start type ,set to disabled.
check out blackviper.com other services not required.
http services id leave alone as you will need IE to browse, set ZA on firewall settings to high , this can cause some proggs to complain try & see.
grc sheilds up is only so good at what it does)
clear the logs ZA holds and start monitoring
which ip is connecting and if succesfully Blocked then the person will eventually get bored and go away u win.
if they persist ,complain to your isp let them do the legal bit.
how do you know your freind is being hacked?
Are they using the built in NAT firewall?
check pcs for keyloggers and trojans ,
a decent Antivirus will sort that.
useful port checker