I found an app called "Open" in the list of login items - can anyone identify what it is?

Through process of elimination, I think the "open" entry you are looking for is that Family Tree Builder app.

EtreCheck works differently than Ventura's "Login Items" list. When EtreCheck sees an "open" entry, or anything similar in behaviour, it goes out and looks for the item that "open" is opening. It checks that file for a digital signature. If it finds one, then it will accept that and mark the launchd file as signed with a big smiley face, and move on to the next one. I guess Ventura isn't that clever. 😄

But anyway, since there is this difference in behaviour, I looked through some other recent EtreCheck reports that people have sent me so that I could see if any of your signed Symantec, Zoom, Microsoft, etc. apps are actually using the "open" mechanism. It doesn't look like they are.

So that leaves the Family Tree Builder app, which is a real odd duck. That plist configuration file does appear to be using "open", and a particularly unusual variant of it too. I double-checked EtreCheck's handling of this variant and EtreCheck seems to be doing it correctly. So I think you really have deleted the Family Tree Builder app. I can guess why. It is a Windows app. And I don't mean it is a Windows app ported to the Mac. It is literally a Windows app running under the WINE cross-platform Window app runner. Boy, that's bush league.

You can use EtreCheck's "clean up" feature in the Security page to remove the orphan launchd plist configuration file for Family Tree Builder and that will eliminate the problem.

I may have to change EtreCheck's handling of these things. I'm working on an update to better support people who are trying to track down mysterious pop-ups and dialogs from Ventura. Normally EtreCheck parses the "open" command and just treats it as running the underlying executable and essentially forgets that "open" was used. But that isn't going to work now because that's the only information you have. So when you search EtreCheck for "open", I need to be able to find any item that uses it.

<sigh>