Two years after WannaCry, a million computers remain at risk