As far as I have seen, the people that pay the ransom do get the decryption key (as the University of Calgary did)however the price varies and can be expensive.

As far as I have seen, the people that pay the ransom do get the decryption key (as the University of Calgary did)however the price varies and can be expensive. If I were your friend, I would try to restore from a restore point. Barring that, paying the ransom and once you have access to your files make an external copy on a separate disk (for analysis) and then wipe the infected computer with a new image.