Virus that renames files and removes file extensions

Basically when certian users close an excel spreadsheet after working on it and saving it to a shared network drive, the file is immediately renamed to what seems to be a random alpha numeric file name, and it removes the file extension.

Now most people know that you can just add the extension back in or chose excel from the program list, but im worried that my users may be infected with something.

We us CA antivirus – all systems are fully updated.

Has anyone heard of this or have some advice on troubleshooting? Any help is much appreciated!