What is W97M.Marker.C.3?

Question

User's Apple ID has been shutdown by Apple for reasons of security.
A scan of the iMac with ClamXAV finds 50 threats of one kind or another, mostly among downloaded email.
Also, many Office 2004 and earlier Word files are quarantined with the Infection Name: W97M.Marker.C.3
My guess is that this indicates a threat embedded in a Word macro.
I'd also like to know if the infected files on this iMac have anything to do with the shutdown this user's Apple ID.
Hardware Overview:
      Model Name: iMac
      Model Identifier: iMac12,2
      Processor Name: Intel Core i5
      Processor Speed: 2.7 GHz
      Number of Processors: 1
      Total Number of Cores: 4
      L2 Cache (per Core): 256 KB
      L3 Cache: 6 MB
      Memory: 4 GB
System Software Overview:
      System Version: Mac OS X 10.7.5 (11G63)
      Kernel Version: Darwin 11.4.2
      Boot Volume: Macintosh HD

Answer 1

It's a macro virus which infects Word documents. Norton has this info on it:
W97M.Marker.damaged Also Known As: W97M.Marker.Gen, W97M/Marker.KC, W97M/Marker.go, W97M/Marker.AO, WM97/Marker-GO
The virus is activated when you close a document that is infected with W97M.Marker.damaged. It replicates in a corrupted form.
When it is executed, W97M.Marker.damaged performs the following actions:
1. It changes a Microsoft Word option, so that when you open a document that contains a macro, the warning message no longer appears.
2. It drops the log file C:\hsf????.sys, (where ???? is a string of four random numbers from 0 to 7), which contains a list of previously infected users.
3. Next, it drops the text file C:\Netldx.vxd with the commands to upload the log file to a remote FTP server.
4. Finally, it runs the Windows file Ftp.exe and passes the file C:\Netldx.vxd as a parameter in an attempt to perform the log file upload. This operation will fail because the IP address of the FTP server cannot be contacted.
As you can see, it's yet another piece of Windows malware that only works on Windows computers. You can be a carrier, but that's all. Stripping the macro out of your documents is the real work on your end. Macros also usually attach themselves to the default template so every new document also gets the macro attached.