One of those "My Website was Hacked" scenarios.
So, first thing that I honestly hope you have, is the latest version of Joomla.
- Joomla 3.x: >> 3.4.3
- Joomla 2.5: >> 2.5.28 (start considering migrating to Joomla 3.x)
- Joomla 1.5: >> You should not even be on this version
- Joomla 1.0: >> I do not sympathize in the slightest
One possible reason for being able to upload a file to the root directory is a vulnerable upload extension, which I can assure you, do exist unfortunately.
Another possibility is having access to your backend. If a hacker gains access to your admin backend, they could upload a simply PHP upload script, allowing them to then upload a tonne of malicious scripts.
Please be sure all your passwords for the admin backend, FTP, cPanel are all strong and preferably different, and also that any extensions you use are always up to date.
I wrote an answer on Stack Overflow a while back with some tips:
Hope this helps
