Thanks, Avast.
After I had installed the 2014.9.0.2016 update, seting the Default Rule to "auto-decide" now make avast firewall remember the ports.
Except the "Svchost" is still granted "Allow connections to all networks".
The inbound ports of "System" is now remembered but not the outbound ones.
I have read the default rules of Windows Firewall, there were many rules associated with "Svchost" & "System".
Avast firewall seems to have granted too much permission to the 2 processes.
I don't understand.