Looking to remove any kind of malware that perpetuates itself with either doing nothing, or a restore.
I guess another thought would be to just to reinstall dom0. and whatever kind of things we have added to dom0. like verification keys to allow some Qubes to be re-installed.
I always reinstall for various reasons, with the main one being that it gives me the chance to reflect upon any issues I had before in the previous version, so that I can address them during reconfiguration.
Located where?
If its located in a VM, its always good to check logs via sys-firewall. What type of malware, if I may ask ?