How exactly does the sandbox behave? Does it automatically put all unknown things in there?
Yes, all application activities are virtualized (see some technical background here: http://forum.avast.com/index.php?topic=57347.msg483820#msg483820). There're some exceptions for web browsers which improve convenience of using them in the sandbox (like downloads may not be always virtualized, etc).
Okay, that gives me serious reservations about using it. I play World of Warcraft regularly and it has periodic updates. These updates come in the form of an updater that is specific to each patch and is named accordingly. Since the new name would make it a new unrecognized file, I'm thinking it would be sandboxed and thus be unable to make the changes to the game files that it needs to do. The game updates themselves are delivered by the downloaders through a built in bittorrent client that connects to other users to get the files.
So, there needs to be a notice given that a file is about to be sandboxed with a choice given of whether to do it or not. I was using the Comodo suite until they introduced a sandbox that was completely unusable for me. I disabled it but grew tired of HIPS so I have changed my setup to what my signature now shows. I'm not a fan of either HIPS or sandboxing at this point.
You said all activities are virtualized. I'm hoping you meant the activities of new unknown applications and not everything in the system.
The avast! Sandbox will not virtualize anything own its own. You have to right click the application and choose to run it in the sandbox. However, you may choose to always run something virtualized.
It will not virtualize everything in the system. It will virtualize all the activities in the currently running
application.
