|Aagainst the rules to multipost the same thread FYI. I have deleted your other one.|
Fact you had no antivirus on the server indicates a minimally configured server which makes it ripe pickings for hackers. Most likely the "upload" is being done by hackers.
This server should be removed from the internet and isolated then rebuilt from scratch. Anything less won't remove the hackers back doors into your system.
You might want to review one of the many available guides for hardening your server.
It's servers like yours that allow botnets to exist on the internet. Get serious about your servers configuration.
Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's