Put some of "unlockers" - Mio Mort, Simple Shell or similar at SD card. Put card in device, then reset it.
Almost all WiNCE devices are configured to first try booting from the card and then from the internal memory.
When you have access in this way, CeCMD usually comes in the package, you can delete sys and/or put another...Delete save folder also (backup it first)