Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?

A stealth/tunneling virus works by intercepting OS-level interrupt service routines (ISRs) and system calls, substituting its own handlers so that when anti-virus software queries the system, the virus returns clean-looking data. By actively corrupting or redirecting these interrupts while the system is running, it hides file size changes, altered sectors, and its own code from scanners. This is precisely the behavior described in the question - active manipulation of service call interruptions during execution.

A macro virus embeds malicious code inside document macros (e.g., Word or Excel files) and executes when the document is opened, not by intercepting OS interrupt calls.

A cavity virus hides by inserting itself into unused 'null' spaces within executable files without increasing file size, but it does not actively intercept or corrupt system interrupt calls.

A polymorphic virus evades detection by mutating its own code signature with each infection cycle, rather than by intercepting or corrupting OS service call interrupts at runtime.