I have the same problem, and manage to solve it . Here's the solution.
check if you have the following folder: C:\ProgramData\Bonanza\
delete it.
under computer management - task scheduler
check if you have the following item "rundll", it runs every hour, disable it or delete it.
you should find the item "PPI Update", it's installed by KMSpico
it opens this website "http://insightlk.com/download/index.php?mn=9995"
which then jumps to "http://sh.st/AeotZ"
delete or disable this item