unplug network cable...

from another computer download linux distro of your choice...

burn disc...

stick in hacked computer and reboot :-)

seriously though, do #1 and starting running your AV and rootkit finder tools to try to find out what 823.exe did or is still doing. hopefully you can clean it up but it might be time to back up (and be careful! what you backup) and reinstall. 

Thanks guys (quick reply too!).

That's what I had suggested pretty much. He's working on it offline now I believe (he's in a different state). I saw that link as well. That leads me to believe that the IP listed in the command is that of a system hosting the worm then, right? Also, so far AVG and Norton have not picked up anything. I haven't been able to locate anything on '823' as of yet.

Not sure if you have identified how the system was compromised or how privileges were escalated.  Milw0rm has an exploit for 823.c but it is for "Dream FTP" and it does not appear to be a local exploit.  You can find the source: http://www.milw0rm.org/exploits/823

Once you have cleaned the system you are going to want to identify how the system was compromised before you put it back online.  You will want to also check any systems that are located on the same network as they might have been the source of the intrusion or may have fallen victim to attacks from this system.  If the other systems are rooted then you may need to resort to monitoring network traffic.

One thing you might consider is backing up all of the business files and reloading the system.  Sometimes this is the best way to handle incidents involving rootkits.  By storing files to a separate media and then scanning them from a separate, protected, system you can be sure that there is no "detectable" malware in these files.  Then you can DBNuke the old hard drive and get rid of anything except for firmware related malware which is highly unlikely.

Just throwing options out there for you to consider as you help your friend with additional risk analysis.

Good luck,
Cutaway

That is actually a very good point.  If this is the case then either the VNC connection was exploited or, more probably, brute forced.  The cracker apparently had a VNC connection to the system.  This system then could have been used to compromise another system using 823.exe or to escalate privileges on the local host.

If your brother-in-law is like most people he might be using this password or something like it on multiple places.  He may want to change ALL of his passwords to something completely different.