Key Function Not Allowed

I got a new puzzle today.

One of my users, at a PC at a remote site, is getting this message solid on
bottom of every 400 screen
at sign on,
options from menus,
exit a program,
like it is solid regardless of keystrokes.

It is not preventing user from doing their job, but perhaps it is symptomatic
of something going flaky that we need to fix.

It almost sounds to me like a computer virus :-)
Someone pulling my leg is not a current possibility on my radar screen

I would not mind user having some garbage at bottom of screen in lieu of
blank, but I am afraid if we not track this down & nip it in the bud it might
get in the way of legitimate messages.

Only the one user out of 50 users on our 400 has reported this, but I have a
MSG *ALL out just in case, since this went a week before it was brought to my
attention.

Apparently this started while the user's local power user experts on
vacation, but getting a job log from these folks is more than is reasonable
to ask of them.

I checked with HQ user who does the same application function & has similar
hardware setup & that user has had no trouble since printer alignment
flakiness which was months ago.  I have not touched the ERP software involved
in eons.

We did have a consultant visiting about the same time this started to go
haywire & the consultant did install a back door into BPCS, which I have
subsequently taken down, and was using the work station that now is reporting
this weird stuff, but I have confirmed that the back door was installed from
a different work station, so if there are any remnants that I have missed,
that is not explaining this.

I know that back doors are not good business practice, but IT staff are the
only people who could care less about security.  I setup sign ons for
visitors, but then the people showing visitors areound forget that I have
done so.

I did not see anything out of the ordinary in
the user's profile
BPCS job description shared by all users
the work station involved - via WRKCFGSTS & various BPCS objects
our message files & queues

Where else does it make sense for me to look?

I asked them to do some simple tests & report back to me.
a) User with the problem try someone else work station.
b) Some other user sign on at the problem work station
Hopefully this will make it obvious
Is the problem stuck on User-Id
or is it linked to that work address?

They have checked for obvious keyboard stuff like dust clogging up so that
some key is stuck - caps lock - insert
I asked them to check status of keyboard play record keys
& to see if they have one of the interfaces where they can call up picture of
keyboard & see which keys the system thinks are pressed

WRKMSGF *ALL then 5 on some prospective message collection shows massive
volume
I could dump these objects to *OUTFILE then query search for matching text
Is there any simpler way to locate where some error message text comes from?

I have asked them to see if cursor on error message line then F1 F6 elicits
additional information & if there is a little plus sign to the far right on
the "message"

If this was a legitimate error message, it would go away as soon as the user
moves to another program or evan another screen.

Some menus have a message about user security constraints
Many programs have various messages

MacWheel99@aol.com (Alister Wm Macintyre) (Al Mac)