> About 1 week later I tried to update just one of the
> child node let say www.abc.com/abc/456/
> so I changed the scan rules to -*
> +www.abc.com/abc/456/*,
> in the end, winhttrack erased all others already
> downloaded except the 456?!!!

Exactly what it should do. The new filter does not include the others, so
those files are no longer in the mirror and are purged at the end.
 
> I once thought the scan rules is just the filter for
> downloading websites but I was wrong!!! I have to

Exactly what it does.

> what should I do to avoid winhttrack to erase
> downloaded files when updating???
NOTHING. The action will automatically be Update. Just run it. Updating is
fast (~3 files/sec.) It just depends on round trip time to server. Independent
on file size.