WordMacro/Safwan activates on the 10th of October. At this time it
displays a dialog box with this text:
Is it your birthday today?
If the answer is yes the virus does not infect the opened document.
Otherwise the virus only spreads. The name of the virus comes from a text
macro it created to check if it has already infected NORMAL.DOT.
Safwan was reported to be in the wild in summer 1997.
[Analysis: Mikko Hypponen, F-Secure]