aurora , aka nail.exe is a spyware and i ve seen it generating pop ups even in safe mode. so answer to your question is yes it is possible. get a hjt log and post it under hjt log forum here. Analysts would give you fixes. I can refer you a removal tool for aurora but i bet it is not the only one in your system. So healthiest way is to work with the analysts.