SophosLabs looked behind a malvertising campaign from September 2015, and found servers that hadn't been patched for two years or more.