This article is from the Computer Viruses FAQ, by Nick FitzGerald firstname.lastname@example.org with numerous contributions by others.
A TUNNELLING VIRUS is one that finds the original interrupt handlers in
DOS and the BIOS and calls them directly, thus bypassing any activity
monitoring program (see D1) which may be loaded and have intercepted the
respective interrupt vectors in its attempt to detect viral activity.
Some antivirus software also uses tunnelling techniques in an attempt to
bypass any unknown or undetected virus that may be active when it runs.