Undesired results from "Remember My Answer" on Allow of Hooks

Version: 4.1.150349.920
Defense+ In Safe Mode
Firewall in Custom Policy Mode
Sandbox Disabled
Windows XP SP3

When an application tries to install a global hook (in itself or something else), and I check the Remember My Answer box and click Allow, the access rights all get changed to Allow (except “Run an executable” which doesn’t have an allow option). I believe these all change to Allow when you tell a program not to run in the sandbox anymore, but that is probably by design because they become trusted applications wen you tell them not to run in the sandbox (this is one of two reasons why I disabled the sandbox).

Here is an example (copied from the alerts displayed log, onevent is for my UPS):
Alert 1:
onevent.exe is trying to execute onevent.exe. What would you like to do?
Expected (based on version 3): Clicking Remember and Allow on Alert 1 listed onevent.exe in the list of allowed applications for the run an executable setting.
Alert 2:
onevent.exe is trying to install global hook onevent.exe. What would you like to do?
Unexpected (based on version 3): Clicking Remember and Allow on Alert 2 marked all Process Access Rights to the default action of Allow instead of adding onevent.exe to the allowed hooks list.

I get the same behavior when a program tries to access the keyboard directly. This issue may encompass all of the actions that are prompted for that aren’t execute an application (which might do the same thing if it had an allow option). I hope this isn’t by design unless there’s a setting to change it somewhere that I haven’t been able find.

I also get the same behavior when an application tries to access protected files. I’m going to go ahead and assume that the behavior is the same for all actions except execute a file and stop posting in this thread. I still should hope it is a bug or a configurable option, but I don’t see any point in posting another 9 replies mentioning the same results for registry and screen and whatever else.

Alright, the behavior doesn’t occur when More Options is selected (and Fewer Options is available to select) on the popup. Maybe this is by design, and maybe it is reasonable. It may even have been this way in 3.x, I’m not even sure now.