Is it possible to create a similar "capture" program that simply captures and returns the btc back to the sender, along with some sort of message that can be used to flag the transaction? This way, over time, it will be easier to determine the source of the code.
This can be done. Great idea.
This would require in real time, immediately after the theft, determining the relation between the private and public key, then deducing the private key, then sending a transaction with a higher fee.
That would be a program. It would have to be activated by a signal from the victim, and he would have to notice the theft pretty quickly and log the request.
I would note that there could be any number of algorithms each with a variety of constants which could be used to deduce the private key from the public key. Once the bad guys knew these counter attacks existed, they would go to more subtle algorithm.