How do i protect my files from unauthorized access on my website?

I use IIS as Webserver with a virtual folder to my files on a share. To view some files the user needs a login, but because of the folder and filename structure he can guess some filenames to access other files which he has no right to view, because the direct path to the file is visible in the code.

How to prevent unauthorized access to this files?