Got the sucker, the path is [strike:3ade9825f6]-http://klikvp.com/xxx/xxx/pdf.pdf-[/strike:3ade9825f6]
here's the contents of the .pdf just 3.17k.
I can make it popup if I reboot my router so I get a different ip address, then it "thinks" I'm another user.
(btw I reboot my router every day so maybe that's why I get it coming up more often)