Thanks everyone here on this list who helped track down this!
We just published a (hopefully more or less final) "Diary" on
this topic at http://isc.sans.org/diary.html (see below for text).
As it turns out, at least one particular version of the software
distributed by PopAdStop.com did include a Trojan component sending
out popup spam.