I just created Windows Firewall rules to block it, since I don't know what it's doing. Problem (mostly?) solved. Might make a startup script that runs 2 minutes after boot and TaskKill's CCleaner in case anything like this is ever tried again. Edit: Just make a new task run 1 minute after login, set it to Admin privs, start this action: Run: C:\Windows\System32\taskkill.exe Arguments: /IM CCleaner64.exe /f Voila, problem solved.