csrss.exe has something to do with DirectX. You should NOT delete this. I have not seen nimda exploit this process. If you deleted it in safemode, Windows XP probably restored the file when you restarted in normal mode when it found it was missing. If you do have nimda, symantec has a free utility to remove many different variants. Their nimda removal tool will automatically close ALL processes related to nimda and allow disinfenction while in normal mode.