What is a "crmpopup screen"? Is this a browser popup?
Could you not add an HttpSessionListener to perform the clean up code when the session is timed out?
But if you intend to disable the cloase button of the browser, then you have to try some Java scripts to do it.
It is not possible to catch all the various ways a browser window could be closed. For example, if a browser is process is killed any client side JavaScript can't run. Its not really worth the effort. As Ulf has already said, preventing the user using their browser exactly as they want to is not something its wise to do. You'll drive them up the wall.