There is a nice writeup by TonikGin on how IRC XDCC Robots are getting installed on Windows boxes and used for file sharing. [Note this is a local copy since his site has been hacked.]
Recently on campus we have been seeing less of the IRC sharing and more of the hackers simply setting up the Serv-u FTP server for both uploads and downloads.
On March 11, 2003 CERT put out advisory CA-2003-08 about increased attacks on Windows Shares.
Microsoft has put together several articles aimed at home users discussing security and privacy basics.
Information from Microsoft on securing Windows 2000 Server.
Windows has several Password Authentication/Encryption methods. Which methods are used are controlled by the value of the LMCompatibilityLevel registry key. You should set this value as high as possible, I recommend a minimum of 3 with a prefered setting of 5. See the articles below for information on changing this setting.
Campus is currently experincing a large number of attacks on Windows computers which take advantage of anonymous registry access using 'Null Sessions'. The most frequent attack is listing the user accounts, especially those with administrator level access, and running fairly basic password crackers on those accounts. This is the type of attack described in the IRC XDCC acticle above. In general this feature is not needed on most computers and Microsoft has documented how to disable it.
For Windows NT http://support.microsoft.com/default.aspx?scid=kb;en-us;143474.
For Windows 2000 http://support.microsoft.com/default.aspx?scid=kb;en-us;246261.
The UPNP service will allow your computer to easily detect and utilize plug-and-play networked devices. When this service was first made available in Windows in 2001 there was a vulnerabilty for which a patch has been available, and you should verify has been installed on your computer.