If Nod32 doesn't say it's infected, the the virus must have replicated the file into the C:\windows\config directory.
As I stated earlier the Winlogon registry key should only be explorer.exe, no other parameters.
Try going to Start > Run, and type msconfig and uncheck all boxes, then restart.