Stop the Hacker

I did not upload any viruses, where did the malware come from?

Your website has a vulnerability. Think of it as a open door in your house. The hacker has used this door to enter your website and deposit malicious computer code.
Your web server has a vulnerability. If you do not host your website yourself, you need to make sure that the web server (computer) which is used to host your website is secure. Even large professional hosting companies have problems. Alternatively, If you host your own website, you can take action now by ordering a Vulnerability to Penetration Assessment.
Your login credentials have been compromised. Hackers often install programs called keyloggers on computers. these programs analyze the keystrokes you are using to type in you password and username. Once the hacker gathers this information they can login to your website silently and wreak havoc. A Web Application Firewall (WAF) will not protect you from this kind of compromise. A website monitoring system will alert you of such a scenario, however.
Third party software installations may have vulnerabilities. If your website uses an online shopping cart, blogging or forum sofware, from a third party, they may have introduced vulnerabilities into your website, which caused your site to get compromised.