Net stop will work, but you're susceptible to a net start command being issued. Disabling the messenger service in the control panel will prevent it from ever being started. IOW, do you lock the door so no one can come through, or do you wall it up so there's no door any more?
And if you were getting the message with ZAPro in place, HiveTyrant, then perhaps someone in your trusted zone is infected. If you've got a router that does logging, you could see where that traffic was coming from (what IP address) and see if you know who that is...
In any case, it appears to be dead now, so good riddance...
