Hacked network. Need snooping software to fix?

Hi there,

I have a customer with a site with 6 servers all running windows 2000 with a few hundred workstations running windows ranging from windows 98 to xp.
Apparently this network is well and truly hacked! All the logon screens have been replaced with dummy screens and the kid who hacked it has all the administrator passwords. We also believe that all the root directories for all the workstations have been compromised across at least 5 of the 6 server and domains.

At the moment we still have server and administrator access although at this point we are not sure if any of the passwords are compromised or not. So I think we are just going to assume that they all are.

I am looking for some sort of software that will scan the network and either kill off all malicious software or return a report with all the system changes and anything else that could be dodgy so we can then go through each pc and clean it.
Anything that could alert the administrator if any system changes are made in the future would be great.

The budget for this software is as yet undecided as I am jsut getting a feel for what is out there.I think what I am after is something like a worm that goes through your network to scan against hacker tools and backdoors?

I am sorry if I am not being clear as this is the first time I have had to deal with something on this scale so any advise would be appreciated.