It took a few tries (it happened almost too
fast to read), but here's what happened:

Before loading Excel, 27 processes
Launch Excel... jumps to 29 processes, then
drops back to 28 processes.

The one that came and went was navw32.exe,
which is Norton. So that answers my first
question: Who is doing the virus scan  --> Norton.