Desktop Coupons folder flagged as PUP.Optional.Spigot.Generic

[Yourcroft]

I created a Coupons folder on my Windows 7 desktop, and when I ran adwcleaner_7.2.4.0.exe it identified the folder as PUP.Optional.Spigot.Generic and quarantined it.  Making a new Coupons folder there leads to the same behavior.  Creating a Coupons folder on the desktop of a different Windows 7 computer and on a different Windows 10 computer desktop gave the same behavior.  I would attach the empty Coupons folder, but that does not seem to be an accepted type.  I suggest you test it by creating a Coupons folder and running adwcleaner.  Creating a Coupons folder elsewhere did not give a false positive. This would seem to be a false-alarm problem with significant consequences if a user's desktop Coupons folder contains valuable coupons, discount codes, etc. only to have them deleted by quarantine. 

[exile360]

Greetings and welcome,

Yes, this detection is the result of a generic heuristics detection to target a known PUP which creates that folder on the user's desktop.  Since you know that the contents of the folder are safe, I would suggest excluding it.  You may do so by performing a scan and then right-clicking on the detected item and selecting the option to exclude the selected item so that it will no longer be detected by future scans.

A member of the staff will need to address the FP consideration, as that is beyond my control, however I would suggest that users creating such a folder is very unlikely and that most users who do, such as yourself, would be aware that they created the folder and that its contents are safe and would therefore have the option to exclude the folder accordingly, while users who are afflicted by the PUP this signature was designed to detect would best be served by continuing to detect and remove the folder if created by the PUP in question, however there may be another way to accomplish this (again though, that's up to the Research team to determine, obviously).

I realize this doesn't completely resolve the issue, but I hope that it at least helps in the meantime so that you don't have to be wary each time you scan with ADWCleaner about allowing it to remove what it detects.