--The DNS traffic is definitely being sent through the VPN. The VPN client configuration for China includes auto-flushing the DNS cache upon access and upon shutdown.
--No malware on machine (that anybody can find.)
--Doesn't happen except accessing from my current (temporary) apartment, which is China Unicom service. Unless I'm missing something, the computer still has to access an ISP even before I activate the VPN. And it seems that THIS is the conceptual electronic interface point where the ISP is inserting the pop-up. How do you access the internet with no ISP?!?! While China (Beijing) Unicom can't see where I'm surfing over the VPN, they can tell that it's a computer hooked up to their ISP servers. And then if I happen to be in an advertising-targeted location, I'll get the popup along with the other users in that area.

--Doesn't happen when I take my computer to work and access, which is a different provider/ISP.
--Pop-up is a separate small window, not part of any frame of any website, and is sporadic....maybe most of the day, every 3-4 days. In Firefox with NoScript Addon, blitzed it. It did start popping up on IE also.

Since it's a temporary apartment and the service, though included in the rent, was not of my choosing and not in my name, I'll have to suck it up and deal, but since (per the Chinese chatter) it seems to be a China/Beijing Unicom problem, I'd probably not use them as a provider voluntarily, except if absolutely no other choice.