Start with a quick firewall checkup using one or more of the online port & security scanners listed here:
http://www.mechbgon.com/build/resources.html If your pop-ups are the kind that come from letting an unfirewalled system directly onto broadband with its Messenger service running, then it's a blessing in disguise that you're getting them, because they revealed an overall security issue: lack of firewall protection.
If that's the case, then put a
router between your DSL modem and your computer, to start with.
Also get some antivirus software installed, patch Windows at
Windows Update and enable Automatic Updates in the Control Panel. Update any Microsoft Office software you might have (Outlook, Word, Excel, PowerPoint, etc) at
Office Update. Uninstall old versions of Flash Player, QuickTime/iTunes, WinAmp, FireFox, Opera, Adobe Reader, etc and install the latest versions to eliminate known vulnerabilities in those.
Scan your system with Microsoft Baseline Security Analyzer and address things that it finds:
http://www.microsoft.com/technet/security/tools/mbsa1/default.mspx
Lastly, rather than the common "don't use IE" advice, I'd lean towards this: make a new user account and make it a member of the Administrators group, give it a decent password like
Peabody@AT, and
only use it when you actually NEED Admin-level power for something. Then put your established user account into the
Users group and remove it from the
Administrators group (right-click My Computer > Manage > Local Users & Groups for moving users among groups, and Control Panel > Users & Passwords can be used too). This takes away the powers that malware usually wants, making any web browser inherently much less of a risk.
Analogous idea on WinXP, for illustration