Clean Malware & Secure PHP Server

My VPS has been flagged for unauthorized file changes and I can already see unfamiliar PHP files appearing in several directories. I host between three and five sites on this box, all of them PHP-based, and at the moment none of them benefit from any form of backup.

What I need you to do:

• Identify and remove every trace of the current infection without breaking production.
• Harden the server and each individual vhost (firewall rules, file/folder permissions, updated PHP modules, disabled insecure functions, etc.) so the same exploit cannot be repeated.
• Implement a reliable backup routine—full site files and databases—stored off-server and retained on a rolling schedule I can adjust later.
• Generate a concise report that shows what was found, what was removed, and exactly which security changes were applied so I can review or replicate them in the future.

Acceptance criteria
– All sites load normally and malware scanners (Maldet, ClamAV or similar) return clean results.
– Backups run automatically and are restorable via a simple command or panel click.
– No new unauthorized files appear during a 48-hour monitoring window.

SSH root access, panel login and any logs you request will be provided immediately after project start.