Hello, I live in Brazil and I was having the same problem described above, and I found a solution (I´m sorry for posting in english, I can´t write in French, had to use Babelfish do translate your messages above).
This was the sequence of actions I used to get rid of these damn files:
Check the processes of Windows Task Manager for .exe files with numbers followed by "exmodula" plus a letter, for example:
46exmodulag.exe
As it was written above, this name varies, in my computer I had several different files, some using "exmodulaf" and "exmodulag". End the process.
Next, go to your
C:\Documents and Settings\Rafael\Local Settings\Temp\
where "Rafael" varies according to the username on your computer. You´ll find several files that follow the format described above. (**exmodula*.exe). Delete them.
Now perform a search on your registry for the "exmodula" word you´ll probably find references to it in the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List key. In this key you´ll find something like this:
C:\DOCUME~1\Rafael\LOCALS~1\Temp\46exmodulag.exe:*:Enabled:Microsoft Update
What this key does is to create a fake entry on Windos Firewall under the name "Windows Update" for each new **exmodula*.exe file it creates. Remove this entry from the registry.
I thought this was enough, but no, those damn files kept coming back after a while!
So I ran HijackThis 1.99.1 (wonderful little program by the way) and it found the file smss.exe (file responsible for automatic windows updates) running in the C:\WINDOWS\system\ folder, wich is wrong. This file is responsible for generating the **exmodula*.exe files. Delete it.
NOTICE: the smss.exe file running under C:\WINDOWS\system32\ is a legal file, do not touch it!
Now search your registry for smss.exe and you´ll find references to it under these keys, delete them.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_USERS\...\Software\Microsoft\Windows\ShellNoRoam\MUICache
Congratulations, it´s done. I hope Google will find this answer, the only reference to this trojan was made here.