Auto-sandboxed software generates alerts (4.0.135239.724 x32)

[Endymion]

@mouse1 post:4

Is the intention to exclude of COM interfaces and hooks from the sandbox’s silent denial documented anywhere?

I got hook alerts since early betas when documentation was not yet available.

COM alerts were were occasionally displayed since early betas.

@Endymion post:49

ActiveDesktop might trigger a COM alert for {75048700-EF1F-11D0-9888-006097DEACF9} GUID.

Blocking that alert will have the test to abort without attempting to write to the registry. The test result will be protected
Allowing that COM alert would get a “vulnerable” result though the real registry will be untouched and the system is Protected.

AFAIK the com alert whose picture you attached would correspond to some V3 Interprocess Memory alerts (perhaps are triggered when some additional condition apply).

Whereas COM alerts could not be triggered sometimes the design decision was unclear but Hooks were predictably able to trigger alerts (or predictably fail in a specific case).