Mike- I’ve been running Comodo Firewall pretty much since it was released (primarily in a sacrificial box but also in VMware) and haven’t experienced anything similar. Post run fault analysis obviously entails inspection of the hidden VTRoot directory where every time the malware can be seen happily playing in virtual oblivion. For the Beta works as it should..
I’m wondering if what you are seeing is due to the installation of the Antivirus. As mentioned above I only care to use the Firewall, seeing no need for a local Comodo AV, as with both the Cloud and Sandbox enabled this would really add little (except a possible bug?).