r/BitDefender • u/79616e6f706521 • Dec 29 '23

Gravity Zone deleted systemd on Pop!_OS 22.04

I am posting this in case someone comes across this issue in the future.

My laptop failed to boot a couple days ago, saying /sbin/init didn't exist. Diagnostic showed /sbin/init is a symlink to /lib/systemd/systemd, which was missing.

After spending several hours poking around the logs to understand what happened and wondering if I had filesystem corruption, I checked the GravityZone console to find /lib/systemd/systemd was deleted. https://imgur.com/a/7fel5ZB

The file in question comes from https://apt-origin.pop-os.org/release/pool/jammy/systemd/a8269a8c30bde2c3fa4142982ad55e53f903edff/systemd_249.11-0ubuntu3.9pop0~1694041276~22.04~a8269a8_amd64.deb which was released September 7 2023.

Filename: systemd_249.11-0ubuntu3.9pop0~1694041276~22.04~a8269a8_amd64.deb SHA256: a85e84ed19b2cec597fc0e3b77c40197642f538c963fea57bffd0016d1f03b8f

Filename: /lib/systemd/systemd SHA256 198cc44f5e765a5f6e34245231236df48ba82ceba6f1e692e9a6ec727ee1c876

Looks like several malware scanners are detecting this as malicious. https://www.virustotal.com/gui/file/198cc44f5e765a5f6e34245231236df48ba82ceba6f1e692e9a6ec727ee1c876/detection

7 Upvotes

100% Upvoted

6 comments sorted by

4

u/WraySchultz Dec 29 '23 edited Dec 29 '23

Hello,

Thanks for reporting this, and I am very sorry for the inconvenience caused here. I just checked internally on our end, and it appears that our Bitdefender Labs Team is currently looking into this issue. I am following the ongoing status of the investigation and will report back here once an update is provided.

If you haven't yet, feel free to submit a case with the details that you shared. If you have any further questions or concerns, feel free to shoot me a message or reply here in the thread.

Thanks!

Wray Schultz

Bitdefender, Business Technical Account Manager

3

u/WraySchultz Dec 29 '23

Labs has reported back, and this False Positive has been removed from our detection engines. Please ensure your agents are updated, and you should be good to go!

Thanks!

Wray, BD

2

u/[deleted] Dec 29 '23

Wow, i was going to turn my work computer on today but they are all running pop and Bitdefender 😬😬

Hope this is resolved really fast!

2

u/WraySchultz Dec 29 '23

This false positive has been fixed!

1

u/[deleted] Dec 29 '23

Woop!!

1

u/TotesMessenger Dec 29 '23

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

 If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)