Hypothetically, say I wrote a worm, call it W1, just for fun/to see if I could, and it had silently infected a large number of computers attached to the internet. Say it didn't do anything but just run on the victims' computers, silently, but without doing anything malicious. However, I'm sure I would have broken some law or another so I decide I want to silently and inconspicuously recall the worm so it is no longer running on anyone's computers so I don't get in trouble.
How would I go about doing so? I would assume the best thing to do would be write a second version of the worm W2 that again silently infects as many computers as possible, and if it detects my original worm tries to remove it. However, there are a number of problems with that:
First, not every computer already infected with W1 will be able to be infected with W2. They may have gone offline, or their virus detection could detect W2 but not W1.
Second, there is the matter of removing W2. Once W2 removes W1 if it finds it (or does nothing if it doesn't), we need to remove W2 or else this whole exercise was pointless. If we program W2 to remove itself before spreading, W2 will never spread. If we program W2 to spread for a bit before removing itself, the computer could become re-infected with W2 (unless we leave a trace there, like a file indicating W2 was there?).
So would this be feasible? Would you be able to remove W1 and W2 without any indication either were ever there? And would it be traceable back to the originator of the worm?
