100% not anti-virus.
90% it is combination of DFS/FRS and Excel.

Files replicated between A and B okay - but B showed real name, A shows
Hex name. Modify file on B and correct name goes to A. Modify file on
A, and update and correct name goes to B - but A renamed as hex.

It actually looks like SHARE permissions. Server A has everyone
"CHANGE" to the data share; whereas Server B has everyone "FULL
CONTROL".

Set server A to "FULL CONTROL" and tests show this looks a bit happier.

!!!??! Why just excel? And why full-control share permission needed to
rename a file!? Thought teh only difference between F/C and Change
share permissions was the right to take ownership and set
permissions???