Forum: Poser - OFFICIAL


Subject: Where's this malware come from? Anyone know how to fix it?

phil_lawson opened this issue on Jul 21, 2026 ยท 13 posts


ChromeStar posted Wed, 22 July 2026 at 10:26 AM

That folder is part of the cache for Internet Explorer, which also handles some web-type content for other software. It merely records where you've been, those are not files that were installed with Poser.

My guess, given that it also affected a new install in a virtual machine, would be that an originally legitimate site referenced by the catalog has now been taken over by something malicious. So when it opens, it gets redirected to open the new site (that you don't want).

Looking at the file, it specifically tries to open contentparadise.com, and a quick check confirms that if you go there in your browser, it's exactly that.

I don't know if there are Poser files that could be updated to avoid going there. However, there are a variety of methods you can use to prevent your computer from accessing a given URL. If you block contentparadise.com, it should prevent it. Here's a variety of methods to do that: https://woshub.com/block-domains-websites-windows-firewall-powershell/