As a part of our WordPress maintenance package, we also offer Malware Removal and regular backups. During such a service, last week we noticed a malware in the functions.php file on one of our clients.
One Google search later we also found the original malware script that was used.
This should stop all popups on your site. But justa regular clean up is not enough. Consider increasing your wesbite security by setting up a Firewall, scheduling backups and monitor login attempts.