Ran into the Aurora popup spyware last week. Very difficult to remove using normal spyware cleanup procedures.

This spyware creates a file called Nail.exe in Windows\System32 and is impossible to delete as it recreates itself almost immediately.

Used this program in Safemode to clear out the Aurora popup. http://www.mypctuneup.com/

Needed to run it twice. After that it looks like Aurora was removed.