safe mode only runs system critical applications and shuts down all networking (unless specified, i think). This disables everything else including viruses and lets you fix problems in a safe environment.
Do thoes pop ups open when your browser is opened or closed?
I also forgot to mention what firewall i use. I use Sygate pro. It was bought out by symantec and is now the firewall they use in thier bundel. I have the last free version of this program and it still works flawlessly as the internet hasnt changed since it was created.