There is no magic panacea to do what you ask.
To go back to things before he deleted stuff, implement a restore point in Windows.
Here is what is happening:
Your son is downloading either software supported by adware or software containing malware.
Whenever you download "free", "free to try", or "trial ware" it will come with adware included. The adware is what makes the software and the services hosting the software to be free. You can usually avoid the installation of the adware by reading carefully each of the screens the program displays during the installation and NOT accepting the terms of the adware. To be clear - you have to accept the license of the software you are installing, but you have to NOT agree to the installation of the adware, often in the form of some tool-bar or browser add-on. This is typically something with a checkbox, but sometimes may result simply from clicking "next" instead of some other option.
To deal with those things is a pain once they are installed because they are pernicious little buggers. One of the things you need to do is to go through the things in the "Programs and Features" of control panel and identify the programs installed there. Sometimes you have to search the net to see what something is. Do this once and you should only need to search new things there in the future. You will want to look at both application names and publisher names.
Next, you will need to look in your web browser at the list(s) of add-ons, plug-ins, and tool-bars and remove any associated with adware (most of them in the case of tool-bars).
Finally you will need to run some anti-adware, anti-spyware software.
Run the free version of two of the following: Spybot Search & Destroy, Adaware anti-spy, SuperAntiSpyware, AdwCleaner.
Next install and run malwarebytes free version.
Now, run one of the following:
CCleaner, Glary Utilities, Tweakingl.com Windows All In One tool.
That brings us to the second of the two sources: software downloads with malware in them (or just straightforward malware). Any "cracked" software, copyrighted software that someone has accessed/modified so that it can installed by someone without a valid license (stolen softwrae, warez/piratebay, etc), will almost always have malware embedded in it. The reason the hackers break the licenseing and then give it away is so that they can profit from you running it - so they embed malware which will generate them some sort of profit. Any unlicensed software must be removed and then to following steps followed:
The most reliable way of removing malware: by [email protected]
The best way to remove viruses from your computer is to boot from something other that your hard
disk. Fortunately, most AV producers provide what is called a Rescue Disk. This is a boot-able CD/DVD or flash drive. On a *clean* computer, download at least one of these programs, preferably two of them. (No AV program gets everything but not many can get past two reputable scanners.) Make the boot-able disk or flash drive, boot the computer with it. Now this image was made a while ago so you will want to update after you boot. Once it has updated set it to work scanning your computer. See the explanation of why this is the case below.
Separate from the others I will offer to you is Kaspersky's TDSSKiller. Not an actual Rescue Disk by itself, it is at the very top of the list of root-kit finders/eliminators. You should run this in addition to at least one of the others:
http://usa.kaspersky.com/downloads/TDSSKiller
Here are 4 of the many free Rescue Disks available:
http://support.kaspersky.com/us/viruses/rescuedisk/
http://www.bitdefender.com/support/how-to-create-a-bitdefender-rescue-cd-627.html
https://www.zonealarm.com/forums/showthread.php/72117-boot-disc-zone-alarm-scan
http://www.lavasoft.com/mylavasoft/support/supportcenter/how-to-create-a-rescue-cd
One of the most difficult things about viruses is once you get one it is difficult to be sure you got rid of all of it/them. Resident programs are pretty effective at blocking initial infection if kept updated, but not so good at removing all of the viruses, especially the worst ones – root-kits.
Think of the entire computer with all the software as a walled city with one outer wall – the rest of the world outside, the computer and the software inside – and then a series of inner walls with fewer and fewer people allowed within the next layer towards the castle in the middle. It is the center wall within which all the power of the kingdom resides. On a computer, in the middle, we have the kernel or heart of the operating system which talks directly with the hardware such as the CPU, motherboard, RAM, etc. Anything that wants to access any of the computer's hardware must go through the OS to get there. In the layers going out, each layer has increasingly less security to go through (and less authority) so that on the very outside where the applications are, there isn't a lot of security or authority to change things on the computer.
Most viruses operate in the outer layers which makes it relatively simple to find, identify and remove. Malware performs various tricks in order to get access to the inner layers. There are, however, some viruses which manage to get access to the kernel level. These are called “Root Kit” viruses. Root is a reference to the center layer. In the Linux and Unix world, a root user has the keys to the kingdom and full control of everything on the machine. With Windows, of course, we don't have a root, we have administrators who actually have a little less authority than Root on Linux/Unix.
The Root-Kits are able to get themselves launched at the same time as the kernel, sometimes as part of the kernel. This happens well before any security software on the machine is launched. As a result, these root-kits have time to hide themselves and even hide other viruses from the security systems/software of the computer. The only reliable way to find them is to perform a virus search before the virus launches which means before the Kernel of the OS launches. By using something other than your hard drive to boot from you have full access to everything on the machine and nothing has time to hide because they never launch.