if they have a copy of the virus/worm they can still analyze it even after it stopps spreading