I like the 4th option. Technical staff and management of sites that serve malware through their ad services should be found guilty of gross negligence, the corporate veil broken, and should be personally financially liable for all the damage their malware caused, in addition to criminal penalties and prison time.