Rgoodsearch.online browser hijacker (virus) - Tutorial

What is Rgoodsearch.online browser hijacker?

Rgoodsearch.online is a browser hijacker that is not easy to remove

The appearance of Rgoodsearch.online indicates the presence of a potentially unwanted program on the system

If you have noticed that your homepage and new tab address of your Google Chrome, Mozilla Firefox, or MS Edge browser has changed to Rgoodsearch.online, you have a browser hijacker installed on your system. Users typically don't install it with intent but are rather tricked into doing so in one way or another. Most commonly, they install it along with freeware ^[1] when not enough attention is being paid to the installation process. This is why people are quite surprised when they open their browser and see it completely altered.

In most cases, the browser hijacking activities start as soon as an extension known as Really Good Search is installed on the device, although it might be caused by an app under a different name. While the changes to the homepage are the most visible changes to users, they are not the most impactful ones.

The most distinctive trait of the Rgoodsearch.online virus is that it sets the “Managed by your organization” setting on the web browser, which takes control over it. This makes it much more difficult to remove it. In the meantime, the potentially unwanted program continues its operation – tracks user data, redirects to suspicious websites, and shows them an artificial layer of ads on many websites they visit.

While the app is classified as a browser hijacker, its operation and function go far beyond that. Keeping it installed can compromise your personal safety and computer security, so we recommend you remove it as soon as possible.

Distribution and prevention

Google's Web Store is filled with thousands of extensions that can be downloaded and installed at any time. Initially, Really Good Search was placed on this store but was swiftly removed due to its malicious functionality. In fact, there are plenty of apps and extensions that Google removes from both Web Store and Play Store after some time. While Google uses sophisticated scanners, some malicious applications might slop through and only show up as such later.

If you have experienced Rgoodsearch.online hijack, it is likely that it happened when you downloaded the extension along with other application(s) from a third-party website. In order to avoid this, you should always pay close attention to the installation process of new programs, especially if you download them from a third-party source.

Software bundling is a well-known distribution technique where additional apps are offered to users while they are installing an app. However, these components are commonly hidden from the view thanks to pre-ticked boxes, fine print text, misleading button placements, and similar. Users often end up with additional apps because they skip through the installation steps and select Recommended settings instead of Advanced ones.

Likewise, you should always protect your computer with SpyHunter 5Combo Cleaner, Malwarebytes, or another reputable antivirus software. Not only can it stop dangerous infections like Utjg ransomware, but it also warns them about potentially unwanted programs that might otherwise be downloaded intentionally.

Really Good Search extensions might set the "Managed by your organization" setting on the browser

Rgoodsearch.online removal explained

Most browser hijackers are considered to be minor computer infections by security experts. They usually operate within the browser environment, although they can drop certain cookies^[2] or other files within AppData or other locations. If you want to get rid of the extension, it is really easy to do in most cases – all you have to do is access browser settings.

It is important to note, however, that this app enables persistence with the “Managed by your organization” setting, which might sometimes be applied to the browser. What it does is abuse the local policy settings or prevent people from tampering with its installation. Removing it manually might be a lengthy process why we explain in our how to fix article.

Nonetheless, this might not be necessary as you could easily remove the unwanted components from your browser, as explained below.

1. Remove the extension

Browser hijackers are commonly installed as extensions or add-ons, and Rgoodsearch.online is no exception. Since the app's main scope is performed within the browser, this is where you should be starting from when attempting its removal.

Google Chrome

• Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
• In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

Mozilla Firefox

• Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the window's top-right).
• Select Add-ons.
• In here, select the unwanted plugin and click Remove.

MS Edge (Chromium)

• Open Edge and click select Settings > Extensions.
• Delete unwanted extensions by clicking Remove.

Safari

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

Note that if you managed to successfully remove Rgoodsearch.online hijacker by using this method, you should also clean your browsers thoroughly. Data such as cookies and cache should be removed to prevent the virus from returning and continuing information tracking. You can employ FortectIntego to do this quickly for you or you can also follow these steps for the manual option (automatic option can also help you fix any damage done by the virus):

Google Chrome

• Click on Menu and pick Settings.
• Under Privacy and security, select Clear browsing data.
• Select Browsing history, Cookies and other site data, as well as Cached images and files.
• Click Clear data.

Mozilla Firefox

• Click Menu and pick Options.
• Go to Privacy & Security section.
• Scroll down to locate Cookies and Site Data.
• Click on Clear Data…
• Select Cookies and Site Data, as well as Cached Web Content, and press Clear.

MS Edge (Chromium)

• Click on Menu and go to Settings.
• Select Privacy and services.
• Under Clear browsing data, pick Choose what to clear.
• Under Time range, pick All time.
• Select Clear now.

Safari

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

2. Reset your browser

Browser reset can help users with unwanted extension removal. The downside of this method is that it would reset all the settings for your browser. It means that you might have to redo its privacy and other preferences, redownload themes, and similar alterations. However, your bookmarks/favorites would remain intact as long as you can log in to your Google account – this works for Google Chrome, Mozilla Firefox, and MS Edge. Likewise, it works in the same way for Mac users on Safari.

Google Chrome

• Click on Menu and select Settings.
• In the Settings, scroll down and click Advanced.
• Scroll down and locate Reset and clean up section.
• Now click Restore settings to their original defaults.
• Confirm with Reset settings.

Mozilla Firefox

• Open Mozilla Firefox browser and click the Menu.
• Go to Help and then choose Troubleshooting Information.
• Under Give Firefox a tune up section, click on Refresh Firefox…
• Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

MS Edge (Chromium)

• Click on Menu and select Settings.
• On the left side, pick Reset settings.
• Select Restore settings to their default values.
• Confirm with Reset.

Safari

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

3. Use anti-malware

As we already mentioned, the persistence techniques this browser hijacker might use can prevent its easy elimination. If you are wondering why this app was removed from Chrome Web Store is simple – it is categorized as malicious by many security vendors and detected as follows, according to Virus Total:^[3]

• Trojan.Win32.Mixer.p
• Generic.mg.a9589b3a151277c4
• Trojan.Dropper.SFX.Generic
• Trojan:MSIL/AgentTesla.LEG!MTB
• Win32:TrojanX-gen [Trj], etc.

As evident, many security applications recognize it as a Trojan, a relatively dangerous computer infection. Nonetheless, you should not panic as it is not as malicious as ransomware or similar, it is simply its deceptive functionality that earned it this classification.

If you have tried Rgoodsearch.online removal with the methods above and were unsuccessful (or even if you were), you should immediately after employ SpyHunter 5Combo Cleaner, Malwarebytes, or another anti-malware and perform a full system scan. Trojans can be used to proliferate other malware, so there could be other infections present on your system. Only by using security software can you be sure that your computer is cleaned of all the nasties at once.