MWB found and quarantined a bunch of threats, I restarted. It's now blocking something from access to "1.winsrw.com" every ~15 seconds which I assume is what caused C to fill.
I'm now running Spybot S+D, and ran MWB again, which found one thing. It's still doing its heuristic analysis thing...