Hi, I tried to respond last night, but my internet connection decided to take a coffee break. Prior to that, I've just been going nuts over here. Moving about 100 web sites over to my new and improved web server.
Anyrate, you pretty much just want to list the directories that you don't want spidered. You could also list individual bots and tell them to not access directories or your entire web site.
At one point (and I'm sure they are still very much out there) I had a site that was getting slammed by psbot. (Google it, they run some sort of image site.) So I told their bot to stay off my entire site with:
User-agent: psbot
Disallow: /
What you have here is good Barbiro. My only concern was in seeing this.
Disallow: /eproducts/
Normally that is a bad idea. But

apparently blocks viewing of the files. Then again, just putting (even a blank .html page) will stop listing.
"Directory Listing Denied
This Virtual Directory does not allow contents to be listed."
I have no idea how good the security is, but I can tell you that the first thing hackers will do is request the robots.txt file to see where the good and otten paid files are.
Hey, if you don't want them showing up in Google etc. they must be good, right? Not always, but you they could be. When they see things like /products, /download, /ebooks etc. they may have hit gold. I got a $100 product once for free with the authors blessing after I first heard about this sort of SE exploit for a product I was interested in... sure enough, his stuff was right there for many to grab for free.

Suffice to say he fixed that hole.
But you need to remember that Google etc. will not even list your directories unless you have a link pointing into them in the first place. Of course you need to consider that someone else might link into your download directories, but a noindex tag on that page should be enough. I would suggest using scripts to block access to download pages anyway though.
Here is a simple checker:
http://www.searchengineworld.com/cgi-bin/robotcheck.cgiYea, this makes no sense.
User-agent: *
allow: /
That site says "there is no allow" and I have to agree.
It should just say
User-agent: *
Disallow: /some-dir
Which says every bot can spider the entire site, oh, except for some-dir.