Bogus Desktop replacement

I am a seasoned adware/spyware combat specialist since I go around town and fix other people's PC for a living.
Recently, I came across something I haven't seen before and could not defeat.
This ladies XP home edition's destop looks like its been taken over by a ad warning of spyware infection and a link for instructions to remove it. And for a mere $60 dolllars they'll sell you a tool to do it.
I can tell its not really the desktop cause I could see a mere sliver of the actual destop showing behind it.
I updated and scanned with both Spybot and Adaware 6.0 and they cleaned up 800 plus objects but not this problem.
Has anyone seen this particular problem and any clues how to deal with it?

Haven't seen it, but maybe have links to things that can combat it!

Have you tried Hijack this?

Also the Cleaner comes highly recommended.

I expect Nihil to step in here any minute now with some suggestions. If those don't work I suggest establishing a cordon around the computer and backing away slowly! ... err come back and I'll find some more stuff :)

WOW...thats odd. Make sure to keep us posted on what it is though, i would like to hear about it, sounds interesting.

Did you check running processes? Hijack this as someone said is good. Also try running your cleaners under a selective startup. msconfig>>selective startup>>load system services or
start in safe mode. Could you post a link?