Thanks for reply,
i found that it is in “HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run” too.
There is register record “20131121”=“C:\Program Files\AVAST Software\Avast\setup\emupdate\737f022d-1098-4dad-9fbb-f3244e2767fc.exe /check”.

So can it be actually from Avast?