Friend had bank account hacked identity stolen

I just got a call from a friend who had their bank account hacked and they asked me to check their home pcs and network to see if that is where it happened. They are pretty careful people but also have a son in college. I plan on doing the usual antivirus stuff and making sure the network is secure as well as seeing if they recently opened any new accounts where the information needed for the indetity theft could have happened, their checking account is with Wells Fargo any other suggestions?

That includes Antimalware, like installing MalwareBytes?

Might help to put on an ethernet packet sniffer like Wireshark [wireshark.org] to verify there is nothing secretly being transmitted underneath the scenes that may not be blocked. You don't have to get that in depth but just a suggestion.

do they shred documents

Give an update OP of what it is if you find out whats the deal. Dont forget spybot.

funny part is about 6 months ago a took a course in Certified Ethical Hacking

Any mobile banking?

Quote from komondor : I just got a call from a friend who had their bank account hacked and they asked me to check their home pcs and network to see if that is where it happened. They are pretty careful people but also have a son in college. I plan on doing the usual antivirus stuff and making sure the network is secure as well as seeing if they recently opened any new accounts where the information needed for the indetity theft could have happened, their checking account is with Wells Fargo any other suggestions?

Don't want to jump to conclusions, but did they rule out their son....

was it for sure inet banking?
local bank here (usbank) had a skimmer on a atm couple years ago. they got about 60k and never had anything on the news about it.
I've been thinking about having 1 pc run a live cd to access online banking. never worried about it before but now personal account and business accounts show up under 1 login.
do the banks reimburse money lost from hacked account

Hacked account, or check fraud? Usually, these things are not done by amazing hackers. Just some guy who got the account number and ordered a bunch of fake checks.

Going over there this afternoon to look at their systems and network, more than likely it was a stolen check or a skimmer as opposed to something on the PC but you never know. I have been cleaning PCs for about 5 years now and this would be my first

Ok went over the the house yesterday wireless is all locked down but did find what I usually do they had the Whole Norton package from Comcast, but it never caught one of those web search redirectors not cool web search but one like it. Hitman Pro found it in less than 5 minutes a complete scan with Norton did not find it, after 2 1/2 of scanning, running SuperAntiSpyware found it in less than 10 minutes and removed it.

It also seems that the Norton package from Comcast does not allow you to schedule a full scan once a week, it does have the option to scan when idle but it sure did not seem to work at all!

It seems a check might have been washed someone deposited a check to verify the account then started to withdraw money like crazy happened to 2 different Wells Fargo accounts

Quote from komondor : Ok went over the the house yesterday wireless is all locked down but did find what I usually do they had the Whole Norton package from Comcast, but it never caught one of those web search redirectors not cool web search but one like it. Hitman Pro found it in less than 5 minutes a complete scan with Norton did not find it, after 2 1/2 of scanning, running SuperAntiSpyware found it in less than 10 minutes and removed it. It also seems that the Norton package from Comcast does not allow you to schedule a full scan once a week, it does have the option to scan when idle but it sure did not seem to work at all! It seems a check might have been washed someone deposited a check to verify the account then started to withdraw money like crazy happened to 2 different Wells Fargo accounts

both accounts show on one login or did they use electronic checks?
makes me want to splint accounts to separate banks
will the bank refund their money?

It could be something as simple as them using their ATM or debit card in an ATM or gas pump that had a skimmer on it.

Are you sure they had their identity stolen or was it just the bank account emptied? Have other credit cards or bank accounts been opened in their name? If not I would assume the skimmer route - it is getting quite common.

Quote from komondor : Ok went over the the house yesterday wireless is all locked down but did find what I usually do they had the Whole Norton package from Comcast, but it never caught one of those web search redirectors not cool web search but one like it. Hitman Pro found it in less than 5 minutes a complete scan with Norton did not find it, after 2 1/2 of scanning, running SuperAntiSpyware found it in less than 10 minutes and removed it. It also seems that the Norton package from Comcast does not allow you to schedule a full scan once a week, it does have the option to scan when idle but it sure did not seem to work at all! It seems a check might have been washed someone deposited a check to verify the account then started to withdraw money like crazy happened to 2 different Wells Fargo accounts

Although it's probably a skimmer elsewhere, always a good thing to run:
http://www.metageek.net/products/inssider/
to see if anything is running nearby.