apache user www-data hack my websites and my vps

The Apache web server runs as user www-data. It needs to have access to your web files.

However, it does not necessarily need to have write access. See this Linode guide for more information on managing permissions.

You will find it impossible to completely clean up your existing system. You need to start with a new install. The problem is whatever service that was compromised, probably one of your web services. With your new install, make sure you are using web services that have the latest security patches. Otherwise it will just be compromised again.

thanks so much!

If you use a managed hosting provider such as LiquidWeb, one of the numerous php cloud hosting services, specialty php hosting services or a shared host like dreamhost, they will take some responsibility on the server side of things. If you can take the advice from the previous article, identify the malicious scripts and simply report them, they will help you clean things up. There are still tips below that will help you remove the malicious scripts yourself and then your hosting provider can check the servers for further intrusion such as root or shell access.

yes,maybe i need to consider changing a host