I restored luainstall.exe to SysWOW64 and system32 yesterday so we're back to square one as I was not sure where we were.
SystemLook 30.07.11 by jpshortstuff
Log created at 21:24 on 25/02/2014 by rrkurtz
Administrator - Elevation successful
========== filefind ==========
Searching for "luainstall.dll"
C:\ESD\Windows\sources\luainstall.dll --a---- 50176 bytes [04:50 30/09/2013] [09:53 22/08/2013]
FFFF498E680E92052683AAFDFAE4D981
C:\Windows\SoftwareDistribution\Download\4c65c56583067a754313aa574a5ada44\amd64_microsoft-windows-
luainstaller_31bf3856ad364e35_6.2.9200.16384_none_718018daf20f86f3\luainstall.dll --a---- 50176 bytes [03:41
25/02/2014] [03:06 26/07/2012] F257056A1044B31F6FE9C67E393ED558
C:\Windows\SoftwareDistribution\Download\bbcd2cf9b320a453d034b77497ec5af5\amd64_microsoft-windows-
servicingstack_31bf3856ad364e35_6.2.9200.16683_none_62280e15510f8e79\luainstall.dll --a---- 50176 bytes [02:30
22/02/2014] [04:21 10/11/2012] FFF365F8805100FDB2A0789723A15FBF
C:\Windows\System32\luainstall.dll --a---- 50176 bytes [03:30 25/02/2014] [03:06 26/07/2012]
F257056A1044B31F6FE9C67E393ED558
C:\Windows\SysWOW64\luainstall.dll --a---- 39424 bytes [02:01 26/07/2012] [03:18 26/07/2012]
902B161E360563DED4F3099C55062411
C:\Windows\WinSxS\amd64_microsoft-windows-luainstaller_31bf3856ad364e35_6.2.9200.16384_none_718018daf20f86f3\luainstall.dll
--a---- 50176 bytes [01:55 26/07/2012] [03:06 26/07/2012] F257056A1044B31F6FE9C67E393ED558
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16384_none_622908ad510eb05b\luainstall.dll
--a---- 510 bytes [05:28 26/07/2012] [21:22 26/12/2013] A4CDED4746E7597B1A7DF708087EE038
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16613_none_6273bd8950d6cae2\luainstall.dll
--a---- 438 bytes [18:59 08/11/2013] [21:22 26/12/2013] 3174425FF50C71D1544504150C5FC1A9
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_62280e15510f8e79\luainstall.dll
--a---- 50176 bytes [18:59 08/11/2013] [18:59 08/11/2013] 8AD518DEB9A867808806CFE0CB953FC9
C:\Windows\WinSxS\x86_microsoft-windows-luainstaller_31bf3856ad364e35_6.2.9200.16384_none_15617d5739b215bd\luainstall.dll
--a---- 39424 bytes [02:01 26/07/2012] [03:18 26/07/2012] 902B161E360563DED4F3099C55062411
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16384_none_060a6d2998b13f25\luainstall.dll
--a---- 506 bytes [05:28 26/07/2012] [19:52 27/12/2013] B270A12D3DA6D63058C0526CC6762013
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16613_none_06552205987959ac\luainstall.dll
--a---- 433 bytes [18:59 08/11/2013] [19:52 27/12/2013] FBEEA251290B0A51F7F35E3BCD0FAC47
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_0609729198b21d43\luainstall.dll
--a---- 39424 bytes [18:59 08/11/2013] [18:59 08/11/2013] 2F98BDD97F521458051F4C281C7B3CF2
Searching for "ntevt.dll"
C:\Windows\SoftwareDistribution\Download\842c98013e1decf29608fc1f0976e551\amd64_microsoft-windows-wmi-ntevent-
provider_31bf3856ad364e35_6.2.9200.16384_none_492347b5369e9a83\ntevt.dll --a---- 239104 bytes [02:30 22/02/2014]
[03:06 26/07/2012] 54EA7E89556AFF96362B62ED8CF2C6C2
C:\Windows\System32\wbem\ntevt.dll --a---- 239104 bytes [23:56 25/07/2012] [03:06 26/07/2012]
1DCDBC457B31CF69C6C52125AB4D343A
C:\Windows\WinSxS\amd64_microsoft-windows-wmi-ntevent-provider_31bf3856ad364e35_6.2.9200.16384_none_492347b5369e9a83\ntevt.dll
--a---- 239104 bytes [23:56 25/07/2012] [03:06 26/07/2012] 54EA7E89556AFF96362B62ED8CF2C6C2
Searching for "MpAsDesc.dll"
C:\Program Files\Windows Defender\MpAsDesc.dll --a---- 150688 bytes [18:48 08/11/2013] [18:48 08/11/2013]
A1C2796F698474BAA1ABD5B80B3835C8
C:\Program Files (x86)\Windows Defender\MpAsDesc.dll --a---- 150688 bytes [18:48 08/11/2013] [18:48 08/11/2013]
DCD1DD102072EFFD763BE1C43EA7E6B4
C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_6.2.9200.16384_none_1e6fca32e090c9e9\MpAsDesc.dll --a----
540 bytes [02:35 26/07/2012] [21:55 26/12/2013] EB4A8D0A24908557B5E4D33ADE443DC5
C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_6.2.9200.16656_none_1e92403ce076a039\MpAsDesc.dll --a----
150688 bytes [18:48 08/11/2013] [18:48 08/11/2013] A1C2796F698474BAA1ABD5B80B3835C8
C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_6.2.9200.20763_none_1f0e0c3df99f0fef\MpAsDesc.dll --a----
90 bytes [18:48 08/11/2013] [21:56 26/12/2013] 061DEB8CB427E5AC4C1E17F87E6030EC
C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_6.2.9200.16384_none_28c4748514f18be4\MpAsDesc.dll --a----
540 bytes [02:45 26/07/2012] [19:39 27/12/2013] 3F85692F917C0BA6A0E915528BA6E1BA
C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_6.2.9200.16656_none_28e6ea8f14d76234\MpAsDesc.dll --a----
150688 bytes [18:48 08/11/2013] [18:48 08/11/2013] DCD1DD102072EFFD763BE1C43EA7E6B4
C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_6.2.9200.20763_none_2962b6902dffd1ea\MpAsDesc.dll --a----
90 bytes [18:48 08/11/2013] [19:40 27/12/2013] 00884113B7DEE3AFDA57288CC987846B
Searching for "certutil.exe"
C:\Windows\SoftwareDistribution\Download\61b6a6052db9481008bdce9699875a42\x86_microsoft-windows-
certutil_31bf3856ad364e35_6.2.9200.16595_none_b22647f804ca8723\certutil.exe --a---- 1013248 bytes [02:30 22/02/2014]
[23:13 23/04/2013] 6498FE5EEE819307EDE2FE17CE849994
C:\Windows\System32\certutil.exe --a---- 1255936 bytes [18:50 08/11/2013] [18:50 08/11/2013]
3C300826241468F59D7C0244B4D8B867
C:\Windows\SysWOW64\certutil.exe --a---- 1013248 bytes [18:50 08/11/2013] [18:50 08/11/2013]
AA6F0DDF483739E723EDFDCCFF83D81B
C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_6.2.9200.16384_none_0e4eaf51bd20c8c3\certutil.exe --a----
130290 bytes [00:08 26/07/2012] [19:47 26/12/2013] F624794C0EBE06332891F3CEFB03BF9F
C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_6.2.9200.16595_none_0e44e37bbd27f859\certutil.exe --a----
1255936 bytes [18:50 08/11/2013] [18:50 08/11/2013] 3C300826241468F59D7C0244B4D8B867
C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_6.2.9200.20699_none_0ed2816ed641fd7f\certutil.exe --a----
100667 bytes [18:50 08/11/2013] [19:48 26/12/2013] 3990DBA4AD3D6C53195347E85B46DDA6
C:\Windows\WinSxS\x86_microsoft-windows-certutil_31bf3856ad364e35_6.2.9200.16384_none_b23013ce04c3578d\certutil.exe --a----
118239 bytes [00:11 26/07/2012] [19:42 27/12/2013] EF9CF0A33D1CA182DB4BE9C67DDBC297
C:\Windows\WinSxS\x86_microsoft-windows-certutil_31bf3856ad364e35_6.2.9200.16595_none_b22647f804ca8723\certutil.exe --a----
1013248 bytes [18:50 08/11/2013] [23:13 23/04/2013] 6498FE5EEE819307EDE2FE17CE849994
C:\Windows\WinSxS\x86_microsoft-windows-certutil_31bf3856ad364e35_6.2.9200.20699_none_b2b3e5eb1de48c49\certutil.exe --a----
64766 bytes [18:50 08/11/2013] [19:42 27/12/2013] 2EF5783326266E5059A47245BF0E58CB
Searching for "fastprox.dll"
C:\Windows\SoftwareDistribution\Download\bbcd2cf9b320a453d034b77497ec5af5\x86_microsoft-windows-servicingstack-
admin_31bf3856ad364e35_6.2.9200.16683_none_bb3528a7dce75509\fastprox.dll --a---- 629248 bytes [02:30 22/02/2014]
[04:22 10/11/2012] 5F2AB03D492FBF39203520EA5B0F397E
C:\Windows\System32\wbem\fastprox.dll --a---- 1004544 bytes [23:57 25/07/2012] [03:05 26/07/2012]
19304E66115DD1400182211B4FD7E73A
C:\Windows\SysWOW64\wbem\fastprox.dll --a---- 784896 bytes [23:58 25/07/2012] [03:18 26/07/2012]
992BD101F370B0D93A1131227BA342F6
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack-admin_31bf3856ad364e35_6.2.9200.16384_none_1754bec39543e821\fastprox.dll
--a---- 1024 bytes [05:28 26/07/2012] [21:22 26/12/2013] C4EE25EB4D48490A640A2A027175DB74
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack-admin_31bf3856ad364e35_6.2.9200.16613_none_179f739f950c02a8\fastprox.dll
--a---- 952 bytes [18:59 08/11/2013] [21:22 26/12/2013] CBE6755F1AC230928A4B7A40B0562EF7
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack-admin_31bf3856ad364e35_6.2.9200.16683_none_1753c42b9544c63f\fastprox.dll
--a---- 816640 bytes [18:59 08/11/2013] [18:59 08/11/2013] FC3DF763798BA2B3B8A74E0BB0D6E088
C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-fastprox-dll_31bf3856ad364e35_6.2.9200.16384_none_5412fabf0380d9df
\fastprox.dll --a---- 1004544 bytes [23:57 25/07/2012] [03:05 26/07/2012] 19304E66115DD1400182211B4FD7E73A
C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-fastprox-dll_31bf3856ad364e35_6.2.9200.16384_none_5e67a51137e19bda
\fastprox.dll --a---- 784896 bytes [23:58 25/07/2012] [03:18 26/07/2012] 992BD101F370B0D93A1131227BA342F6
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack-admin_31bf3856ad364e35_6.2.9200.16384_none_bb36233fdce676eb\fastprox.dll
--a---- 1082 bytes [05:28 26/07/2012] [19:52 27/12/2013] 0ADED59A8942C4022B630063F0BFE10E
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack-admin_31bf3856ad364e35_6.2.9200.16613_none_bb80d81bdcae9172\fastprox.dll
--a---- 1011 bytes [18:59 08/11/2013] [19:52 27/12/2013] C3687F98784C1AF182136BDBADC5961A
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack-admin_31bf3856ad364e35_6.2.9200.16683_none_bb3528a7dce75509\fastprox.dll
--a---- 629248 bytes [18:59 08/11/2013] [18:59 08/11/2013] FF1B827D398A7F86B2430CD59C1B3BE3
Searching for "smipi.dll"
C:\Windows\SoftwareDistribution\Download\bbcd2cf9b320a453d034b77497ec5af5\x86_microsoft-windows-
servicingstack_31bf3856ad364e35_6.2.9200.16683_none_0609729198b21d43\smipi.dll --a---- 102400 bytes [02:30 22/02/2014]
[04:22 10/11/2012] 635E77F4B45CF16FC72F37F1BD6EDC9A
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16384_none_622908ad510eb05b\smipi.dll
--a---- 524 bytes [05:28 26/07/2012] [21:22 26/12/2013] 08310E6CBB7045CD40909F3470B407C6
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16613_none_6273bd8950d6cae2\smipi.dll
--a---- 110592 bytes [18:59 08/11/2013] [18:59 08/11/2013] CB888288B2C27CCE8668164D8A9DADE3
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_62280e15510f8e79\smipi.dll
--a---- 110592 bytes [18:59 08/11/2013] [18:59 08/11/2013] CB888288B2C27CCE8668164D8A9DADE3
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16384_none_060a6d2998b13f25\smipi.dll --a----
496 bytes [05:28 26/07/2012] [19:52 27/12/2013] B1E26D26F0BC945B3B63C6E3B0331CC3
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16613_none_06552205987959ac\smipi.dll --a----
423 bytes [18:59 08/11/2013] [19:52 27/12/2013] FA83DF83DB24704374E6609B82DB4B98
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_0609729198b21d43\smipi.dll --a----
102400 bytes [18:59 08/11/2013] [18:59 08/11/2013] 3C895823F27B8FAE6F5AA3A56A0926C4
-= EOF =-
Here is output of Collect.bat:
View attachment 38427