Yes it is legal to back up your CD's...no its not legal to "lend" those backups to a friend (to be honest in my day I was kind enough to run an ofsite backup location for most of my friends floppies ). As for the virus a company has shipped media with viri before. Some examples would be whatever was in winzip and micalangalo shiped on HD. Oh and MS shiped a virus with one of the versions of 95.

as for waht to do about it...call the company and demand that they sned you a clean CD at their cost. (but if NA is detecting the virus I don't see what the issue is on the copy)