YourRadioNow presents itself as a convenient browser extension for streaming radio stations, but security researchers classify it as a potentially unwanted program (PUP) that hijacks browser settings and tracks user activity. Once installed, this software modifies your homepage, default search engine, and new tab page without clear consent, redirecting searches through advertising networks that generate revenue for its developers. While not as destructive as ransomware or banking trojans, YourRadioNow creates persistent annoyances, slows browser performance, and exposes users to privacy risks through extensive data collection.
Many users discover YourRadioNow on their systems without remembering its installation—a telltale sign of bundled software tactics. The extension typically arrives alongside free downloads from third-party software sites, where installation wizards use pre-checked boxes and misleading "Recommended" settings to slip the unwanted program onto your machine. Once active, YourRadioNow proves difficult to remove through normal uninstallation procedures, often leaving behind registry entries, scheduled tasks, and browser policies that restore the hijacker even after you think you've deleted it.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Aliases | YourRadioNow Toolbar, Radio.yourradionow.com, Search.yourradionow.com |
| Affected Platforms | Windows 7/8/10/11 (all editions); primarily targets Chrome, Firefox, Edge |
| First Documented | Circa 2017 (part of the Mindspark Interactive Network family) |
| Distribution Method | Software bundling, deceptive advertisements, fake update prompts |
| Persistence Mechanisms | Browser extension policies, registry Run keys, scheduled tasks, shortcut modifications |
| Primary Capabilities | Homepage/search hijacking, click tracking, search query redirection, advertisement injection |
| Data Collection | Search queries, browsing history, clicked links, geolocation data, system information |
| Network Behavior | Communicates with yourradionow.com, hp.myway.com, search.myway.com, and various ad networks |
| Common Artifacts | Browser extension ID matching YourRadioNow pattern, modified browser shortcuts with appended URLs |
| Payload Delivery | Does not typically download additional malware, though bundled installers may include other PUPs |
| Removal Difficulty | Moderate—requires browser cleanup, registry editing, and policy removal beyond standard uninstallation |
How It Spreads
YourRadioNow rarely arrives alone. The software publisher behind this hijacker—Mindspark Interactive Network—operates dozens of similar browser extensions disguised as useful tools for weather forecasts, recipe searches, package tracking, and media streaming. These programs spread primarily through software bundling arrangements with free download sites that repackage legitimate applications (video converters, PDF readers, download managers) with additional "offers" pre-selected during installation.
The deception happens during installation wizards that use Dark Pattern design techniques. Users who click through "Express" or "Recommended" installation options unknowingly agree to install YourRadioNow alongside their intended software. The checkboxes authorizing the additional software are pre-checked, worded ambiguously ("Enhance your browsing experience with premium tools"), and sometimes hidden behind expandable "Advanced Options" sections that most users never open. By the time the installation completes, YourRadioNow has already modified browser settings and established persistence mechanisms.
Beyond bundled installers, YourRadioNow spreads through several additional vectors:
- Fake browser update notifications that appear on low-quality streaming sites or file-sharing platforms, claiming your browser needs an update to view content
- Malvertising campaigns where compromised ad networks serve pop-ups promoting the "YourRadioNow" extension as a legitimate radio streaming service
- Direct installation from official browser extension stores (though listings are periodically removed and re-uploaded under slight name variations)
- Social engineering emails with download links disguised as media player requirements or codec installers
- Pirated software packages where torrent uploaders include the hijacker in cracked application bundles
- Compromised installer mirrors for popular free software, where attackers replace legitimate downloads with modified versions
What It Does On Your Machine
Upon installation, YourRadioNow immediately takes control of your browser's core navigation settings. Your homepage changes to a customized search page hosted on yourradionow.com or a related domain in the Myway network. New tabs open to this same page instead of your browser's default. Most significantly, your default search engine gets replaced with a Myway-branded search that routes all queries through advertising partners before delivering results—often of lower quality than Google or Bing would provide directly.
The hijacker installs as a browser extension with elevated permissions that allow it to "read and change all your data on the websites you visit"—a frighteningly broad authorization. These permissions enable YourRadioNow to monitor every search query, track which links you click, record how long you spend on pages, and harvest metadata about your browsing patterns. This data flows back to Mindspark's servers where it builds detailed behavioral profiles used for targeted advertising. While the privacy policy claims data is "anonymized," the granularity of tracking often makes individual identification possible through behavioral fingerprinting.
Beyond data collection, YourRadioNow degrades browser performance in noticeable ways. Pages load more slowly because each navigation request must first contact the hijacker's redirect servers. Memory consumption increases as the extension runs constant background scripts monitoring your activity. Some users report frequent browser crashes or freezes, particularly when opening multiple tabs. The extension also injects additional advertisements into search results and may display pop-under windows promoting other Mindspark products or affiliated software offers.
The hijacker's persistence mechanisms work in layers to survive removal attempts. Even after you uninstall the browser extension through normal channels, YourRadioNow often returns because scheduled tasks reinstall it automatically, registry entries restore browser settings, or group policy objects (on some variants) prevent you from changing your homepage. Desktop and taskbar browser shortcuts get modified with command-line parameters that force specific start pages regardless of browser settings. This multi-layered approach frustrates users who "remove" the hijacker multiple times only to see it reappear after the next reboot.
Manual Removal — Step by Step
Disconnect Network and Document Symptoms
Before making any changes, disconnect your computer from the internet (unplug Ethernet or disable Wi-Fi) to prevent the hijacker from downloading updates or additional components. Take screenshots of your current browser homepage and search engine settings—you'll need to verify these return to normal after cleanup. Note which browsers are affected, as YourRadioNow can infect multiple browsers simultaneously.
Boot to Safe Mode with Networking
Restart your computer and press F8 repeatedly during boot (or Shift+Restart on Windows 10/11, then Troubleshoot > Advanced Options > Startup Settings > Restart > press 5 for Safe Mode with Networking). Safe Mode prevents most startup items from loading, which stops YourRadioNow's scheduled tasks from reinstalling components while you work. You'll need networking enabled for Step 7 when you download security tools.
Uninstall YourRadioNow Through Control Panel
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11). Look for entries named "YourRadioNow," "Mindspark Toolbar," or anything with recent installation dates you don't recognize. Uninstall each suspicious program. The hijacker may appear under various names including version numbers like "YourRadioNow_8h" or similar alphanumeric suffixes. Also remove any other Mindspark products or unfamiliar toolbars from the same publisher.
Remove Browser Extensions
Open each installed browser and navigate to the extensions/add-ons manager (chrome://extensions in Chrome, about:addons in Firefox, edge://extensions in Edge). Remove YourRadioNow and any other extensions you didn't intentionally install. Don't just disable them—click "Remove" to delete completely. Pay attention to extensions with permissions to "read and change all your data" that you don't recognize. Restart each browser after removing extensions.
Delete Scheduled Tasks and Registry Entries
Open Task Scheduler (type "Task Scheduler" in Start menu search) and look in the Task Scheduler Library for tasks containing "YourRadioNow," "Mindspark," or random alphanumeric names with recent creation dates. Delete these tasks. Next, press Win+R, type "regedit" and press Enter. Navigate to HKEY_CURRENT_USER\Software and HKEY_LOCAL_MACHINE\Software\WOW6432Node, then delete any folders named "YourRadioNow," "Mindspark," or related variants. Also check HKCU\Software\Microsoft\Windows\CurrentVersion\Run for YourRadioNow startup entries and delete them. Back up your registry first if you're uncomfortable with this step.
Clean Browser Shortcuts and Reset Settings
Right-click your browser shortcuts on the desktop and taskbar, select Properties, and check the "Target" field. Remove anything after the .exe (especially URLs like "http://search.yourradionow.com"). In each browser, reset settings to defaults: Chrome (Settings > Reset settings > Restore settings to their original defaults), Firefox (Help > More troubleshooting information > Refresh Firefox), Edge (Settings > Reset settings > Restore settings to their default values). This removes hijacked homepage and search engine settings.
Scan with Malwarebytes and AdwCleaner
Download Malwarebytes Free (from malwarebytes.com—the official site only) and AdwCleaner (also from Malwarebytes). Run a full scan with Malwarebytes first, quarantining everything it finds. Then run AdwCleaner, which specializes in browser hijackers and PUPs. Let it clean what it detects and reboot when prompted. These tools catch leftover files, registry entries, and browser policies that manual removal often misses. The free versions are sufficient for this one-time cleanup.
Verify Browser Settings and Change Passwords
Restart your computer normally (exit Safe Mode) and open each browser. Verify your homepage and search engine have returned to your preferences and that no YourRadioNow pages appear. Search for something and confirm results come from your chosen search engine, not Myway redirects. Because YourRadioNow tracked your browsing activity, change passwords for important accounts (email, banking, shopping) using a different, clean device if possible—or at minimum, after confirming complete removal.
Check for Bundled Secondary Infections
Installers that delivered YourRadioNow often included additional unwanted programs. Review your installed programs list again for other recent additions—weather toolbars, coupon extensions, "PC optimizer" utilities, or anything from publishers you don't recognize. Run a second Malwarebytes scan 24 hours after the first to catch any secondary infections that may have been dormant during initial cleanup. YourRadioNow itself doesn't download malware, but its installation source frequently bundles other threats.
Monitor for Reinstallation
For the next week, watch for signs of YourRadioNow returning—unexpected homepage changes, new browser extensions appearing, or search redirects. If it reappears, you likely missed a scheduled task or registry persistence mechanism. Some variants install browser policy files in C:\Windows\System32\GroupPolicy or %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup that need manual deletion. If the hijacker persists despite thorough manual removal, professional assistance may be needed to identify the remaining hook.
Prevention
- Download software only from official publisher websites. Avoid third-party download portals like download.com, softonic.com, or similar aggregators that bundle additional software with legitimate programs. When you need VLC media player, get it from videolan.org—not from a search result promising "Free VLC Download with Bonus Tools."
- Always choose Custom/Advanced installation. Never click "Express Install" or "Recommended Settings" when installing software. Custom installation modes reveal bundled offers that Express modes auto-accept. Read each screen, uncheck pre-selected boxes for toolbars or browser extensions, and decline any "special offers" that aren't part of your intended download.
- Keep a reputable ad blocker installed. Extensions like uBlock Origin prevent many malvertising attacks that distribute browser hijackers. They block the fake download buttons and deceptive update prompts that trick users into installing YourRadioNow. Configure the blocker to use multiple filter lists including anti-malware lists.
- Review browser extensions monthly. Open your extensions manager regularly and remove anything you don't actively use or don't remember installing. Legitimate extensions sometimes get sold to new owners who transform them into data collectors or hijackers through automatic updates—vigilance catches these transitions before they cause problems.
- Disable browser extension installation from unknown sources. In Chrome and Edge, you can configure settings to prevent extension installations from outside the official store. In Firefox, set "xpinstall.signatures.required" to true in about:config. This blocks many hijacker installation methods, though determined threats may bypass these protections.
- Use a standard user account for daily activities. Create an administrator account for software installation and updates, but use a standard (non-admin) account for web browsing and routine tasks. Many PUP installers fail when run without administrator privileges, adding a barrier against drive-by installations.
- Keep Windows and browsers updated. Security patches close vulnerabilities that allow malicious extensions to install without proper authorization prompts. Enable automatic updates for Windows, Chrome, Firefox, and Edge so you receive security fixes as soon as they're available. Out-of-date browsers are significantly more vulnerable to hijacker installation through exploit kits.
- Be skeptical of browser permission requests. When installing any browser extension—even seemingly legitimate ones—read the permission list carefully. Extensions requesting to "read and change all your data on the websites you visit" should raise immediate suspicion unless they have a clear, justifiable reason (like password managers or ad blockers). A radio streaming tool has no legitimate need for such broad permissions.
When Computer Repair Roswell removes YourRadioNow or any other malware from your computer, we back our work with a 90-day reinfection warranty. If the same threat returns within three months, we'll clean it again at no charge. We don't just delete the visible infection—we identify and eliminate the persistence mechanisms that cause hijackers to keep coming back, then harden your system against reinfection.
Bring It In
Browser hijackers like YourRadioNow might seem like minor annoyances compared to ransomware or banking trojans, but the privacy invasion and system degradation they cause deserve professional attention. The longer these programs remain active, the more data they collect about your online activities—and the bundled installers that delivered YourRadioNow often include additional threats that manual removal misses. If you've followed the removal steps above and still experience search redirects, performance problems, or suspicious browser behavior, you're likely dealing with a more complex infection that needs expert diagnostics.
Computer Repair Roswell specializes in complete malware removal for Roswell, Alpharetta, and North Fulton County residents. We service both PCs and Macs at our shop on Woodstock Street, typically completing browser hijacker removal within 24 hours. Our technicians use professional-grade tools that go beyond consumer antivirus software, identifying rootkit components, bootkit infections, and persistence mechanisms that free scanners miss. Call us at (770) 666-0456 or stop by during business hours—no appointment necessary for malware emergencies. We'll give you a honest assessment of your infection, a firm price quote before starting work, and your clean computer back with improved defenses against future infections.