diff --git a/host_vars/file-km.anw-km.netz/file-km-common.yml b/host_vars/file-km.anw-km.netz/file-km-common.yml
index 48ac791..b8e8dcc 100644
--- a/host_vars/file-km.anw-km.netz/file-km-common.yml
+++ b/host_vars/file-km.anw-km.netz/file-km-common.yml
@@ -843,6 +843,8 @@ samba_shares:
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
     vfs_object_virusfilter: true
+    vfs_object_virusfilter_include_files:
+      - eml
     vfs_object_recycle: false
 
   - name: eibelshaeuser
@@ -901,6 +903,10 @@ samba_shares:
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
     vfs_object_virusfilter: true
+    vfs_object_virusfilter_include_files:
+      - eml
+      - exe
+      - msi
     vfs_object_recycle: true
     recycle_path: "@Recycle"
     vfs_object_recycle_is_visible: true
@@ -925,6 +931,9 @@ samba_shares:
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
     vfs_object_virusfilter: true
+    vfs_object_virusfilter_exclude_files:
+      - docx
+      - pdf
     vfs_object_recycle: true
     recycle_path: "@Recycle"
     vfs_object_recycle_is_visible: true
diff --git a/roles/common/templates/etc/samba/smb.conf.j2 b/roles/common/templates/etc/samba/smb.conf.j2
index 6b4210f..24fa7d3 100644
--- a/roles/common/templates/etc/samba/smb.conf.j2
+++ b/roles/common/templates/etc/samba/smb.conf.j2
@@ -532,6 +532,20 @@
    virusfilter:scan on open = yes
    virusfilter:scan on close = yes
 
+{%      set virusfilter_include_files = item.vfs_object_virusfilter_include_files | default([]) %}
+{%      set virusfilter_exclude_files = item.vfs_object_virusfilter_exlude_files | default(item.vfs_object_virusfilter_exclude_files | default([])) %}
+{%      if virusfilter_include_files | length > 0 %}
+   # Nur diese Dateiendungen vom Virusfilter pruefen.
+   virusfilter:include files = \.({{ virusfilter_include_files | join('|') }})$
+{%         if virusfilter_exclude_files | length > 0 %}
+   # Include und Exclude sind gesetzt: Include hat Vorrang, Exclude wird ignoriert.
+   #virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
+{%         endif %}
+{%      elif virusfilter_exclude_files | length > 0 %}
+   # Diese Dateiendungen von der Viruspruefung ausschliessen.
+   virusfilter:exclude files = \.({{ virusfilter_exclude_files | join('|') }})$
+{%      endif %}
+
    # Fehlercode bei infizierter Datei (beim Öffnen)
    virusfilter:infected file errno on open = EACCES