A method for antivirus in a mobile device is performed by using a mobile storage and a system thereof. The method includes a mobile storage that is connected to a mobile device. The control module in the mobile storage automatically runs. The control module obtains root privilege of the operation system of the mobile device, and calls virus-killing module in the mobile storage to eliminate a file(s) or program(s) threatening security of the mobile device. The advantage is to obtain the newest antivirus method by using a mobile storage when a mobile device is unable to update antivirus software through internet.