This is an ugly spyware when u install something from untrusted source.

One key sympton is that when u open default browser, a default url is opened  http://www.hao601.com/?tn5_9_30=27711

Even if u set default home URL to about:blank, that URL is still opened.

In fact, it is implemented by appending that URL to ur browser’s quick start URL. So right click ur browser icon, property, remove “http://www.hao601.com/?tn5_9_30=27711” from target.