diff --git a/defaults/main.yml b/defaults/main.yml
index 83c4ed5..cbb1cf4 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -27,7 +27,19 @@ server_scripts_domains_check_dns: "8.8.8.8"
 server_scripts_domains_assert_ip: "your_server_ip"
 
 server_scripts_detect_viruses_log: "{{ server_scripts_logs_base_path }}/detect-viruses.log"
-server_scripts_detect_viruses_php_signatures: 'eval(base64_decode\|eval(stripslashes\|FilesMan\|WSO_VERSION\|\$sF=\"PCT4BA6ODSE_\"\|\$qV=\"stop_\"\|=chr('
+server_scripts_detect_viruses_php_signatures:
+  - 'eval(base64_decode'
+  - 'eval(stripslashes'
+  - 'FilesMan'
+  - 'WSO_VERSION'
+  - '\$sF=\"PCT4BA6ODSE_\"'
+  - '\$qV=\"stop_\"'
+  - '=chr('
+  - '\.chr(101'
+  - 'b374k'
+  - "'base'\\.(32\\*"
+server_scripts_detect_viruses_php_signatures_excluded: "filesManag"
+server_scripts_detect_viruses_php_files_excluded: 'easy-captcha.php\|tfpdf.php'
 server_scripts_detect_viruses_js_signatures: "document.write(unescape"
 
 server_scripts_drupal_build_archives_projects_root: /usr/local/drupal
diff --git a/templates/server-scripts.conf.j2 b/templates/server-scripts.conf.j2
index 9f3f3c2..af7e27d 100644
--- a/templates/server-scripts.conf.j2
+++ b/templates/server-scripts.conf.j2
@@ -35,7 +35,9 @@ DOMAINS_CHECK_ASSERT_IP="{{ server_scripts_domains_assert_ip }}"
 
 # detect-viruses
 VIRUSES_LOG="{{ server_scripts_detect_viruses_log }}"
-VIRUSES_PHP_SIGNATURES="{{ server_scripts_detect_viruses_php_signatures }}"
+VIRUSES_PHP_SIGNATURES="{{ server_scripts_detect_viruses_php_signatures | join('\|') }}"
+VIRUSES_PHP_SIGNATURES_EXCLUDED="{{ server_scripts_detect_viruses_php_signatures_excluded }}"
+VIRUSES_PHP_FILES_EXCLUDED="{{ server_scripts_detect_viruses_php_files_excluded }}"
 VIRUSES_JS_SIGNATURES="{{ server_scripts_detect_viruses_js_signatures }}"
 
 # drupal-build-archives