I have already fixed my installations (3 WP with the same problem on the same host). I made a lot of tests (about several weeks and scientific method ;o) ) and a vulnerabilty in backWPup is my last conclusion (even if I can off course be wrong).
Thanks for the links : I have done the entire list of the first link few times (more than 5). Only when I didn’t upload again the plugin, installation was staying clean until today (it was more than 1 month ago – and attacks came between 3 and 7 days after the cleanup).
Nico