Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?

A cavity virus hides by inserting its payload into empty or unused sections of an executable file without changing the file's overall size, but it does not manipulate interrupt calls or system service responses to actively deceive AV software.

A polymorphic virus evades detection by encrypting its body and mutating its decryption routine with each new infection to avoid matching known AV signatures, rather than intercepting OS interrupts to hide from scans at runtime.

A tunneling virus attempts to bypass antivirus hooks by communicating directly with lower-level interrupt handlers below the layer where AV software has inserted its intercepts, rather than altering the interrupt call responses themselves.

Stealth viruses hook directly into OS interrupt service routines - such as INT 13h (disk I/O) or INT 21h (file system calls) - and actively alter the responses fed back to the antivirus scanner. When the AV reads an infected file or memory region, the virus intercepts the call and returns the original, uninfected content, deceiving the scanner. This active interception and corruption of service call interrupts is the defining characteristic of stealth viruses.