so, noted that avast had created new folder into /setup for instup called New_110408f6, odd part is that instup exists in /setup and in /setup/New_110408f6 at same time, latter is one avast is trying to invoke but strange manner is that it keeps hammering firewall 2-3times a second nonstop for several minutes, feels almost like malign software at this point as it doesnt even bother wait to get pass ...just endless hammering
