On a Windows Vista computer, the path to the winlogon folder is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
The key of interest in the Winlogon folder is Userinit. I want to see if it points to userinit.exe or to some other file, which might be a virus.
On the Windows CE computer, I only see:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
There is no Windows NT.