Question about malware & Sandboxie

I just recently began playing with malware inside Sandboxie...inside VMplayer.
I'm not really very malware or Sandboxie sauvy; I just wanted to test out my security set up.

For the past week I've visited the 'malwaredomainslist' and 'malc0de' websites and tested
probably -- 300 or 400 malwares on my computer and nothing has gotten past Comodo/Sandboxie.

However, when I go back and look at the logs, I noticed that 2 or 3 times, a virus would be blocked
that was trying to write to C:\user -- instead of the normal C:\Sandbox -- is this normal?
If Comodo hadn't caught it would it be writing outside the sandbox?

Please excuse my ignorance.

Thanks

Hard to know really. Maybe try testing that same malware with Comodo disabled.

Ok, I'll do that.

Thanks.