Sounds like your friend is using ZoneEdit.com as her DNS host. They added popups to their web forwarding service, but so far only for cloaked (cloaked means the domain being forwarded stays in the URL address bar, rather than it showing the URL of the site it took you to) forwards as far as I know. As a quick fix I’d suggest removing the cloaking.
Here’s an official statement from ZoneEdit.com support I found at http://www.dslreports.com/forum/remark,15344934:
“The popup ads are a recent addition to our free web forwarding service.
ZoneEdit was recently purchased by Dotster, and it’s their policy to
include popup ads on free accounts that use web forwarding.
With the purchase of one zone credit, popup ads are disabled. One zone
credit is $10.95, and quantity discounts are available.”
