@hake, we have to live with it. I finally came to the conclusion that's how it has to be, unless you want a convenient, but much weaker, protection. Emergency update is not routine. Yes, it runs often checking. Just connects out to check and stops when there's nothing to do. But the download and a new .exe file is infrequent and a pest of sorts.
@bob3160, The issue is not "access through the firewall".
Avast setup and emergency update need outbound connection to avast servers and get it.
The random named executables never want any outbound.
The debate is about what avast emergency runs. It loads and runs a child process of a random named .exe file.
Just like a trojan would from an infected website or an obfuscated link in email.
A good firewall watches that sort of thing. It sees it as a new executable file and alerts. Even if the filename were the same, it will be seen as a change. See the Outpost discussion in a link I showed in post#4 as well as more of my ramblings in post#12 in this thread.
Edit:
In post#14 , dolphins shows the behavior logged new executables, and here's mine from yesterday - see pic.
Not a TCP to http port connection at all, just a new .exe file to deal with when emergency launches the new file just loaded into \setup.
