Some of our sensitive internal documents are appearing in Google as an FTP link.

We have a couple .txt files containing order information (nothing related to billing or credit cards) appearing on google!

The way they are appearing are as FTP files not HTTP. For example, this is one of the links.

ftp://website.com/subfolder/anotherolder/filename.txt‎;
ftp://12-34-56-78.static-ip.isp.com/subfolder/.../invoice.pdf‎;

We run our own web server, using windows server 2008. How do I even begin stopping these folder from being accessed other then robots.txt? Is modifying htaccess the best route?

EDIT, I'm used to linux, there is no htaccess, so how would I use the default windows server way of blocking access to subfolders from direct linking?