I figure it's a legal liability issue. What if the NYT provides instructions for removing the adware, and if following those instructions create problems for some user(s)? NYT's legal team probably concluded that it'd create unnecessary legal exposure.

The culprit should not be NYT; it's the company that's spreading the adware.

An interesting thought experiment might be: what if TiVo replaced TV commercials with their own ad's..?

Why should the NYTimes have to spend their resources and lose their revenue to educate and support people removing that software? That's an expensive cat and mouse game that they shouldn't be forced to play.

Better that they should have to spend the same money in additional taxes to support government investigations and prosecutions, only to have the bad guys move offshore and keep at it?

I think you're perhaps overestimating the cost of banning such things too. For one thing, there is no reason to go it alone. Major ad networks should be providing websites with tools to identify and disinfect affected clients. Then the cost to the NY Times et al would be little more than installing the supplied tools on their servers.

In addition, there is a certain amount of "starve them and they die" that needs to happen here. If something is illegal but still profitable, it continues to happen. On the other hand, if it becomes unprofitable because no websites will service infected clients then it disappears even if it's still legal.

The cost isn't in implementing the detection or writing a nice notice, it's in supporting the people it's for. Removal can be hard, look at Sony's bs with rootkits the other year.

Aside from that websites are a terrible way to fix a problem, there's probably still a massive amount of the internet 'best viewed in X' even though standards and non-IE browsers have been popularized for years. It's taken like a decade of campaigning, education and updates to reduce IE6 to insignificance.

Browser / operating system vendors are in a good position to tackle it and there's precedence for that too, but a single website even as big as the NYTimes is in a weak position to do anything except sue.

You don't literally have to have every website on board. You just need a critical mass such that any given malware-infected user will encounter a website that they consider important but that they can't access, and therefore have an incentive to take steps to remove the malware. That goes a long way to deprive the malware authors of infected users, even if there continue to be some websites that don't block the malware.

And as for browser and OS vendors, it seems like there is a clear way for the Times to push that along: If this problem is nontrivially impacting ad revenue then Google has a clear incentive to work with them on Chrome and Android, and with that as leverage, they can go to other browser and OS vendors and say "take the same measures to keep your users from coming to our website infected with this crap or we'll be recommending that they use Google's products instead."

I'm concerned about the the integrity of the user's computer. That is where I propose legal steps should be taken against the company.

The problem with legal solutions is the global market problem. Ban it in the US and EU and you'll still see it being peddled from Russia and China and infecting world-wide computer users all the same. But at the same time you shackle your economy with (invariably overbroad) legislation that increases compliance costs for small businesses and entrepreneurs and gives large corporations another bludgeon to use against smaller competitors.

Better to just let the market put the bad guys out of business because the good guys all blacklist them.