Removal is the first step. The part that matters is finding how it got in and making sure the same path doesn't work twice.
After cleanup we look at what let it in: an unpatched browser, a mail filter set too loosely, an account with more access than the job requires. Removal without that step usually means the same call again in a few months.