disable "messenger serice"
net stop messenger
But messenger (aka winpopup) service uses SMB (the windoze file/printer sharing protocol), if your brother said this also happens on _HIGH SECURITY BANK COMPUTERS_, whoever has configured security on those machines/firewalls/network they are on should've been FIRED years ago, nothing like that should not be running, and certainly not accessible from the internet. Popup spam may be new thing, but file shares have been notorious and very well known security hole for years.
