... Avast's emergency update "camouflages" itself. It presents its requests to the firewall as a different program, with a different filename -- a RANDOM filename, for God's sake -- upon which the firewall does its job, which is asking the admin to okay or not okay access by a program that has *never* run before ....
So make a wild card for that program under avastEmUpdate.exe. I run Comodo set to Paranoid Mode in Defence + and eventhough I have avastEmUpdate set as a Installer/Updater if a new program runs, like you said, I get an alert. I did not use
* to make the wild card because is to generic, anything can pass by, but you can use
? in the serial number that way the file has to be as set by avast!
C:\Program files\AVAST Software\Avast\Setup\
??-?
-?
-?
-?
??.exe
I have it under avastEmUpdate under execute programs and also alone as a rule for Installer/Updater.