I am not a Comodo sandbox expert. However, there are a number of postings in this forum that state that the “partially limited” sandbox setting which is the lowest setting, might leave you vulnerable to sandbox “jumping”.
You might want to bump the sandbox setting up a level at a time and see at what level it catches that malware. The Comodo sandboxing tutorial on the Gizmo freeware web site recommends restricted or untrusted. The key element would also be at what higher level would there a conflict with your other real time anti-malware scanners.
The following applies to Comodo ver. 5.x. Another question I forgot to ask is if you have virtualization turned on in the sandbox for both registry and system files? If those are turned off and you are running with Defense+ rights of partial limited, you are indeed going to possibly see modifications to both your real registry and system files when malware is running in the sandbox. With virtualization turned on, the only thing malware can modify is the virtual copies of the registry and system files.
