I've put some copies of live, legally-traded shows of my favorite bands in a few caches out here. I think it's a great idea, and would love to come across some myself...
It's as simple as saying only original retail copies, or freely distributed material, no?
And worrying about a virus from the CD? Are any of you worried that the ammo box will be booby-trapped when you open it? I wouldn't be getting into geocaching if there are real concerns about other geocachers like this...
There are 678 artists currently sharing recordings here:
http://www.archive.org/audio/etree.php