ETA: Found it, in the process of fixing it. Figured out how I got it: was looking for a transcript of a House episode, and found it on a site called "twiztv.com". There was something else right after that in my Firefox history from a "advance-actions.com" site. The end of the URL (a "secure.cgi?" file) was a short string of gobbledygook. The same string is in an .ini file in one of the Zinaps folder that ended up on my computer.
Be advised to block both sites in whatever browser you're using.
Bleah, fucking assholes.