ram would be the easiest upgrade, it's cheap and you could probably just add a chip and continue using what you already have. A windows user running firewall, anti-virus and anti-spyware will almost always see an improvement with more ram.
cpu upgrade can be problematic, and if your motherboard is old the fsb is going to limit the improvement you can see and the number of choices available. for example, i have an asus p4b with a 400 fsb and have a 2.4 processor (the fastest 400.) making mb upgrade necessary first.
any windows user will know that upgrading a hd is a day of work or more, but you do have a lot of options here. even an old computer like mine can take advantage of the newer hard drives with more space, larger memory caches, higher rpm's and other efficiency features. you may need to add something like a sata2 card to take full advantage and you also usually have the option of keeping your old drive and turning it into a slave (always use the new drive as the boot drive.)
my last upgrade choice was the hd and i added the sata card. it gave me the best options and i can now use windows(2k) or linux(debian.) i also figured i could migrate the new drive to my next computer.