So, today I noticed a message from Windows Defender that it had found and cleared a Trojan. It popped up just after I'd launched Poser (Pro 2014). I have the External Adobe Air Library activated and not the defunct internal one.

I did some testing and digging to find that the problem files are in the Appdata Local folder under my user account in a hidden folder.

and using Notepad++ to open it found some very odd content inside it.

Its what looks like an Indian betting site that's somehow linked to the old Content Paradise site.

If I put the Library back to Internal the file isn't created and Defender doesn't bug me. Put the Library back to External and even after clearing the files out of the folder and the other folders in the IE folder it comes back.

I don't actually know if this is the file that's causing me the issue or if its what's called a false positive caused by using old software (I really should upgrade Poser you know).

Has anyone else seen this and dealt with it? Am I being paranoid? I know I haven't been on any dodgy websites and I've certainly not been betting so I'm stumped!

I'm not sure how to reach out to the Tech's but I've just created a clean virtual machine and installed PP2014 onto it. As soon as I activated the External library up pop the folders and files, with slightly different names and there they are. The Indian betting site!

Also on the first launch of Poser with the External library a website for Moho 125 opened. That's software for 2D graphics by the looks of it. Maybe I'm just chasing shadows.

I now have a decent internet connection (finally) so time to get saving for that much needed upgrade! 

To contact support, go to https://support.posersoftware.com/. I don't know if they can help you with that old of a version, but it won't hurt to ask. If not, and you have the 2014 game dev version, ask about the Poser 11 upgrade. They originally gave everyone with the game dev license a free upgrade to Poser 11 when Smith Micro shut down the phone home server. I know some people chose to fall back to 2014 vanilla. I don't know if it's still available. That will qualify you for the upgrade versions of either Poser 13 or 14.

that is very strange...

i use PP2014 for everything aside for conversion of clothing because a while back several "rooms" [think SetUp Room/Cloth/Fitting] became corrupted in PP2014 and since there's no way for me to register it if i try to re-install, i just haven't bothered to try to fix them.

i just went to my own AppData>Local folder and i don't even have the file you have in yours.  in fact, i only have one folder inside my Local folder belonging to Corel.

apart from the room corruption that occurred after a Windows Update, PP2014, at least for now, is working just fine.

oh, i'm using PPO to give me my Libraries, in case that info is of any value...

That folder is part of the cache for Internet Explorer, which also handles some web-type content for other software. It merely records where you've been, those are not files that were installed with Poser.

My guess, given that it also affected a new install in a virtual machine, would be that an originally legitimate site referenced by the catalog has now been taken over by something malicious. So when it opens, it gets redirected to open the new site (that you don't want).

Looking at the file, it specifically tries to open contentparadise.com, and a quick check confirms that if you go there in your browser, it's exactly that.

I don't know if there are Poser files that could be updated to avoid going there. However, there are a variety of methods you can use to prevent your computer from accessing a given URL. If you block contentparadise.com, it should prevent it. Here's a variety of methods to do that: https://woshub.com/block-domains-websites-windows-firewall-powershell/

this sounds more like an issue with "search_parms[1].htm" Poser EXE is loaded with hyper links allot that have nothing in common with Poser it self I counted once over 70 hyperlinks actually main reason why Poser exe is so large hyperlinks take more then half the size. "search_parms[1].htm" generate a HTML/Redirector.E!AMTB this file will randomly open a site now days, in the background I assume so your protection will prevent the action and remove the tracker ... 

Content Paradise issue is a notification in older Poser that causes an error as the site does not exist any longer you can block the error simply by adding this line into your Host file 

127.0.0.1 www.contentparadise.com

this line would be if you might encounter another issue it is also a link that is down and gets loaded when running Poser

127.0.0.1 www.producturlsupport.com

did not bother about the search_parms[1].htm as defender just removes the file on start so until now there was no need to search here it gets generated

from what I could find it is a JS command, if you have JS installed then go to settings - security and turn off Java to run in your browser this can also fix issues for older Poser versions that load JS Trackers or redirectors ....

you can also go into the hidden folder where it generates the file , make a empty dummy htm file ( Name it "search_parms[1].htm" ) and set it protected, the file can not be overwritten or removed after shutting down poser, the redirector JS file can not be generated on your machine for poser in the AppData\Local\Microsoft\Windows\INetCache\IE

WOW! There's a lot of clever people out there! I'll be trying out these various fixes tomorrow although an update to 14 is still on the cards.

I've realised that all my software is seriously out of date, I'm using Premier 4 & Photoshop 6 in a virtual machine as it won't run on my latest hardware, Bryce 7 and Hexagon 2.5 that I know I purchased once upon a time but I can't remember where from.

Still, it all works and I'm having fun using it all.

Hmm, very odd. Does look like contentparadise has been, erm, 'borrowed'..

You can open any Poser exe in Notepad +++ and then check with Incremental search the Http links you will be surprised :) even Poser 13 still carries the support.contentparadise.com links and runtimedna.com .... or things like mybrowserinfo.com so might be best to block poser exe to access internet as as soon a site is sold you never know wat you end up with ....

Simple solution: Block Poser 10/2014 Pro from access to the internet. Problem Solved.

Poser 10/2014 Pro no longer has any legitimate need or reason to access the internet since only the Game Dev branch needed to phone home, and those servers are all dead now.

Thanks for the advice, I already had the PoserPro exe added to the firewall both inbound and outbound so I followed the link posted by ChromeStar and completely blocked contentparadise.com. No more messages and no more content in the hidden folders. I've learnt something new too!