Yes, infection is removed, but files are still encrypted. If they can rollback files, that's good. Then we can use file I mentioned to decrypt all other files.
Trick is to have two identical files, one clean and one encrypted. Then all other files can be decrypted.