This virus comes probably from Spain. It is a simple EXE infector with a slightly changing decryptor. When an infected file is executed the virus installs itself into the memory using the function “Terminate Stay Resident”. The virus hooks the interrupt INT 21h and by means of the DOS EXEC function it starts a carrier program, and that is not very common with viruses. The virus will not install itself if it finds that Windows is present in memory. Four months after the initial infection the virus inserts the following strings to the end of AUTOEXEC.BAT.

@Echo Virus "EL MOSTRO CORDOBES".
@Echo No tema por sus datos. Que pase un buen día.
@Echo.
@Pause

Cordobes is a fast infector. It attacks EXE files when searching through the directories contents but it attacks maximum 5 files at one time. Upon infection it alters extension EXE in the name for another, different one. When the virus finds file CHKLIST.MS, it deletes it. It may interfere with Novell Netware because of unsuitably chosen virus identification in memory (on INT 21h/AX=0F000h is returned AX=0FFFFh).