Hello,
> Which processes are still running? The one running as root or those
> running as www-data or both?
Both of them. One as root and several itch children running as www-data.
> You can also try (as root)
> lsof -i -P|egrep TCP.*:80
Result:
apache2 11032 root 3u IPv6 3029567 TCP *:80 (LISTEN)
So it is apache.
--
Regards
Vladislav Kurz