A method, device, and a computer storage medium are provided. The method includes: starting a core file and building an environment after running an operation system, then loading a driver in the built environment; reading a configuration file by the driver to obtain a path of a malware; and deleting a registry and file of the malware in a kernel layer according to the path. The device includes: a start loading module configured to start a core file and build an environment after running an operation system, then load a driver in the built environment; a path reading module configured to calculate a configuration file by the driver to obtain a path of a malware; and a program deleting module configured to delete a registry and file of the malware in a kernel layer according to the path.