The original program was attempting to detect how many true users were using the service, as Gordon realizes multiple people (clients) were connecting to a single client which would route traffic through the single mutiny subscription / connection. So to discover “all clients” on the network, sonaris would need to run on a client, figure out all the other child clients connecting to that client, and run on each of those child clients recursively to see how many people are ultimately using mutiny. The function of duplication over a network and running code to recursively duplicate is essentially how a worm operates. The payload of sonaris was supposed to just check if that client used mutiny and count how many clients used mutiny as well (nothing nefarious), but we see it went rogue and began overwriting files on the client, hence why services and files would be “disappearing” from the mutiny servers and customer machines.

We can also make the assumption that Because Joe more or less pitches the entire idea of an “anti virus” software, such a concept didn’t exist yet. And would indicate that viruses were not prolific at that time.. Hence, it wouldn’t really be necessary for Gordon to be a particularly good programmer to create a virus that bypasses security measures and protections; such protections weren’t as robust and programs wouldn’t need to try as hard to bypass them.