Ah, the double-whammy of crappy Microsoft goods.
Historically, IE has always been about as secure as a house with an open door with a flashing neon sign saying “Free Stuff!!!”. Vista has it’s own issues, but they are not related to your pop-up problem.
Firefox doesn’t do the pop-up thing unless you explicitly allow it to, and unlike the alleged “pop-up blockers” for IE, it really doesn’t allow pop-ups. You get the occasional warning that a site tried to open one and a choice as to whether or not to allow it, but it does not happen.
Chrome is not bad if you just need a very basic browser without all the bells and whistles, but I find it to be like a car without a radio; not too comfortable for long periods. You may like it better though (my wife does) so I mention it here.
As long as you run IE, you are going to have this issue.
While you are at it, get Avira Free and do a sweep. It’s over 99% effective unlike most anti-virus programs and is free also unlike many AV programs. If it beats Norton, McAffee, and damn near everyone else and doesn’t cost a dime, what do you have to lose?
What Avira doesn’t cach, Spybot S&D generally can; it targets a different kind of malware.