The embodiment of the invention discloses a method and device for deleting vicious documents and an electronic device, relating to the field of computer software so that the problem in the prior art that system safety is poor because shutdown callback functions are deleted and vicious documents are fails to be deleted when shutdown. The method comprises following steps: receiving a booting instruction of a user; creating a callback function based on the booting instruction; utilizing the callback function to obtain information on system processes for booting when system processes are started under detections and deleting pre-stored vicious documents when booted system processes are programs that a user logs in based on information on the booted system processes. The method is suitable for a antivirus program.