Different suggestions work for different machines.
I should have quoted the interesting part.
The poster offers a way to uninstall the offending update in a system already compromised.
If you can boot into your recovery environment and open a command prompt, you can follow its instruction starting from 3).
3) At the command prompt - first determine what drive letter your boot volume is assigned. On mine, it was E:. It will likely be C: D: or E:. You might find that do a c: - then doing dir - hitting enter or d: - dir - enter - will be easiest to figure out which drive it is. You could also go into diskpart and look at the Volumes (diskpart (enter) - list volumes (enter) )
4) Substitute the correct drive letter in each of these commands (where e:\ is your Windows volume)
dism /image:e:\ /get-packages
5) After you run this command - it will show a list of packages. Look for the most recently installed - it likely will say "Install Pending"
6) Take that Package identity from those results and run the following command (where package name is the package you want to remove):
dism /image:e:\ /remove-package /packagename:Package_for_RollupFix~31bf385ad364e35~amd64~~15063.850.1.10