I've seen posts pop up every once in a while on virus coding, and I went to flag them, but I didn't see a category under which to do so. After further investigation, I've had no luck finding rules against it, so I presume this means that there are no rules against it (correct me if i'm wrong). So my question is, why is this allowed, is it even legal, and should we allow it?
Why not, virus coding is knowledge like anything else. It can be used for antiviruses, system core programming etc.
Studying viruses is not bad per se. Releasing them is. Studying security vulnerabilities makes good people fix them, bad people exploit them.
Censoring virus-related topics will not stop virus authors. Those are good enough to go on without stackoverflow.com. It will only decrease knowledge about the viruses, and potentially raising developers for companies like AVG, Avast, etc.
Of course, not those openly illicit. But let's not be naive - a real virus creator would not go here and ask "Hey I want to make a virus." Those who would are most likely not capable of creating it anyway.
If the questions are blatantly obvious things like "How do I make code that replicates itself while hiding from virus scanners?", or "Here's my half-built virus, why isn't it phoning home to the control servers correctly?" there are honestly probably legal issues with us helping people (Insert standard IANAL disclaimer), and the questions really should be held/closed/deleted ASAP.
If the question is more along the lines of "I've been studying XXX virus, and wanted to know how it does YYY", or "How does Antivirus program X detect whether a file is a virus?", then those are perfectly fine. They're about programming, and if nothing else, learning to fight malware requires a working knowledge of techniques and ideas.
Think of it this way, any black-hat can easily do a web-search for actual, live, production code, so security-through-obscurity does nothing.
On the other hand, the tone of the question is important. If it sounds like someone is trying to create something to use, then there’s no sense in facilitating that; you may as well close it and force them to do it the hard way which at worst will delay them, at best cause them to abandon the effort.
If it seems to be a legitimate question from a someone looking for ways to harden systems, then it is perfectly viable.