Yes. We first contain and clean, then harden so it doesn’t repeat. In some cases we will recommend restoring from a clean backup if core files are too damaged.