I'm ashamed to say that it was my own router pulling tricks on me. Edit: googling revealed that dd-wrt's "Block ActiveX" feature actually blocks too much, including Windows Update. Unticking it solved my problem.
P.S.: I also found out that I can burn verified UEFI version from the motherboard manufacturer onto a CD and then flash it on boot, enable secure boot and then reinstall Windows again. This is as close as I can get to setting everything to factory defaults, so in theory it should take care of most UEFI malware. I'll do that unless I get satisfactory answer to why the link in the OP isn't working (its downloading process keeps restarting, which looks like something malware would do).