Sorry, I should have clarified. A new VPS/image/machine. I would not simply create a "new site" on the box that got hacked as I too would assume evil is lurking outside of apache.

Douse it with gasoline and toast some marshmallows as I spin up a new instance imo :)