ESET was actually the first thing I suspected, but the feature was hidden so far back that I missed it in earlier disable-all tests.