Research from security vendor Finjan Inc. suggests enterprise IT shops are losing the war against those who would hijack company computers for botnets. Almost half the victims appear to be in the U.S. -- most using Microsoft's Internet Explorer (IE) browser. [Related: Botnets: 4 Reasons It's Getting Harder to Find and Fight Them]

Slideshow: 10 of the Worst Moments in Network Security History

Finjan's Malicious Code Research Center (MCRC) uncovered a network of 1.9 million Trojan horses running on corporate, government and consumer computers around the world during an investigation of command-and-control servers run by botnet herders from the Ukraine and elsewhere. One server, launched in February but later shut down, was hosted in the Ukraine and controlled by an online gang of six people who managed to establish a vast Trojan distribution network. [Related: What a Botnet Looks Like:]

"Hackers keep looking for improved ways to distribute malware and Trojans are winning the race. The sophistication of the crimeware and the staggering amount of infected computers proves these people are raising the bar," Finjan CTO Yuval Ben-Itzhak said. "Corporate and governmental data remain prime targets, especially computers in the U.S. and the U.K. which are under attack, and need to protect themselves." [Podcast: Botnet Battle: How to Fight Back, Part 1]

Based on posts found on various hacking forums, researchers believe 1,000 hijacked computers are being rented out for $100-$200 a day. The bad guys can make $190,000 a day for renting a botnet of 1.9 million infected computers.

The Trojan horse programs are silently dropped on computers when the user visits compromised websites that hide the malware. The giant command-and-control server researchers uncovered includes the IP addresses of infected machines as well as the computers' name inside corporate and government networks that are running the Trojan horse.

Computers in 77 government-owned domains (.gov) from the U.S., U.K., Brazil, Turkey and India have been compromised and are running the Trojan horse. The malware is remotely controlled by hackers who use them to deliver almost any command on the end-user computer as they see fit, including reading e-mails, copying files, recording keystrokes, sending spam, and making screenshots.