Shoutbox

This would still be something that virus scanners would pick up on pretty quickly I think. There are warnings everywhere saying not to accept files from people you don't know and to virus scan every file you receive anyway. If your virus checking client has an auto-protect function then it will automatically scan the file before it is allowed to be called by MP2 so it makes scenarios such as you suggested possible but still something that can pass the blame back to the user who accepted the file transfer (unless another script accepts it automatically, but that would still involve accepting a file transfer at some point), and also could blame the user for not having virus-scanning software installed.