Suspicious RemotePairing.framework?

DoogyDawg wrote:

MacBook Pro 2020.

Ventura 13.5.2

I ran EtreCheck just out of interest and there is a unsigned file which is loaded.

If I click remove, it says it can't remove it, but unloaded it.

I have tried to follow the instructions it gives on removing it, but it wont drag to the bin.

The moment I unload it, then run EtreCheck again, straight after, it's loaded again.

I have tried starting in safe mode to see of it still there, and it is, and loaded.

Any Ideas...in layman's terms?

It was only installed last Saturday morning, I haven't installed anything around that date.

The last thing was an update to my NORD VPN, but that was Tuesday.

https://discussions.apple.com/content/attachment/9525bf1a-66cd-43c4-ba5f-b7fa6235952c

Any Ideas...about what?

What is your issue..?

default—

You are most likely using an ancient version of EtreCheck. EtreCheck only knows about the operating systems that existed when you downloaded it. If you use an old version of EtreCheck on a new operating system, it's going to light up the place. All those new locations are protected by SIP, so you can't do any damage. But you should still update to the latest version of EtreCheckPro. There will be a new version that supports Sonoma in a couple of days.

It does seem suspicious. That is a normal system file, as far as I can tell. The date Sep 2 seems consistent with Ventura 13.5.2. I am still running 13.5.1 and I have those files, just with a different date.