The status=no would be it but, it doesn't work anymore due to security updates. Also, it is implied, so need not be listed - if any browser will allow it, simply not listing it will remove it from the pop up.
I'm not sure about the font tag, bold tag, etc. These really shouldn't be used anyway, as they have been deprecated in favor of css style. The issue here though, is that you need to make as direct of an association between the anchor tag's event and the link trigger as possible. The operative condition being 'user activated'. IE can be particularly finicky about this.
One thing I forgot to add is that you should also return false after your onclick event: