I suspect the files are already on the system in a file we're not detecting.  Our load point diagnostic tool details out what's in the loading points and helps us determine files that might be suspicious.

I'd recommend that you contact support so we can get this tool to you, then review the data it provides.

It is also possible that this could be coming over the network.  Depending on how often the alerts happen, and if you can afford the time off the network, you might want to try unplugging the network cable and see if the alerts stop.  if they stop, it's a good bet they're coming across the network...try a packet capture program and look for unexpected connections, usually over the default shares (like C$ and Admin$).

If the alerts don't stop when off the network, we need to get a better look at the machine (via load point diag) to see if we can get to the root of the issue, get those files submitted and deal with the threat(s).

Is this message appears when you open Internet explorer or any browser.

We had to battle this one recently. When we were battleling this everytime new definitions came down we detected more machines.  We eventually pulled the latest rapid release definitions and then did a full scan of all machines.   That helped greatly in removing it from the network.
 

Thanks Vikram. I found a couple of add-ons in Firefox and IE that I disabled. Hopefully that shuts down the pop-ups. So far the SEP protection hasn't found anything yet this morning, but that comes and goes and it's still early in the day here. Appreciate the idea! :-)