There's been a lot of great advice here, but I thought I would chime in with a different reference. I found the book Working Effectively with Legacy Code by Michael Feathers to be quite good for this particular issue.

One thing that Feathers covers that most other testing books don't is that the normal unit testing approach does not usually work well with legacy code (which he defines as code with no tests). He suggested a tactic he calls characterization tests. Instead of trying to verify correct behavior as you would with unit tests, characterization tests focus on current behavior.

Before making changes to legacy code (bug fixes, feature additions, refactorings, etc.), you would start by characterizing the current code, in the area of interest, with tests. Then, you can modify the tests and code in something approximating normal unit testing.

One of the most important points in the book is the explanation of the different tactics that you need to use for legacy code and new code that can be properly unit tested.