Using a system distinct from a mobile device, the mobile device is switched from a first mode to a second mode to access a set of data storage locations in the mobile device. All malware-susceptible data stored in the set of data storage locations is received at the system from the mobile device to form received data, which is analyzed at the system to detect a malware from a set of malware in a first portion of the received data. Responsive to the analyzing, the first portion of the received data is modified at the system to form a modified first portion, wherein the modifying removes the malware from the first portion. The system stores the modified first portion in a first data storage location in the mobile device and a second portion of the received data in a second data storage location in the mobile device.