It has two problems which may be related:
1. One of the sites is a Drupal site and it appears to have been hacked. Phony php files are being injected into the code base, which I have been cleaning up manually.
2. ... The server tends to become unresponsive, and I have to reboot the server.
The job is to:
1. Investigate the Drupal site that has been hacked, apply any security patches or updates, and fix any other relevant security problems.
2. ... If necessary, move the sites to a new AWS instance and kill the old one.
You should be a good sys admin with Drupal knowledge and experience.