Gooodsonline is a browser hijacker that forcibly redirects your searches and homepage to unfamiliar search engines, flooding your screen with advertisements and drastically slowing down your browsing experience. This potentially unwanted program (PUP) infiltrates systems bundled with free software downloads, then proceeds to modify browser settings without permission and track your online activities. While not as destructive as ransomware or banking trojans, Gooodsonline creates persistent annoyances, compromises your privacy, and can expose you to more serious threats through the deceptive ads and links it injects into your web sessions.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Classification | Browser Hijacker / Potentially Unwanted Program (PUP) |
| Primary Family | Search-redirect adware family |
| Aliases | Gooodsonline redirect, Gooodsonline virus (colloquial), search.gooodsonline variants |
| Platform | Windows (all versions), affects Chrome, Firefox, Edge, Internet Explorer |
| Distribution Method | Software bundling, fake updates, deceptive installers |
| Persistence Mechanisms | Browser extension installation, shortcut modification, registry key creation, scheduled tasks (in some variants) |
| Primary Capabilities | Homepage/search engine modification, ad injection, click tracking, affiliate revenue generation |
| Data Collection | Search queries, browsing history, clicked links, IP address, system information |
| Network Behavior | Redirects through multiple intermediary domains before reaching final destination; communicates with ad networks and tracking servers |
| Common Artifacts | Browser extensions with random names, modified browser shortcuts with --homepage flags, HKCU registry keys for browser settings |
| Damage Potential | Low to moderate — primarily causes annoyance and privacy concerns, but can lead to exposure to scams and malvertising |
| Removal Difficulty | Moderate — resets browser settings persistently and may reinstall components if not thoroughly cleaned |
How It Spreads
Gooodsonline relies almost exclusively on deception to gain entry to your system. The most common infection vector is software bundling, where the hijacker piggybacks on legitimate-looking free software installers. When you download a free PDF converter, video player, or system utility from a third-party download site, the installer often includes "recommended" additional software in pre-checked boxes. Users who rush through installation by repeatedly clicking "Next" without reading each screen inadvertently authorize Gooodsonline's installation.
The hijacker also spreads through fake update notifications that appear while browsing compromised or low-quality websites. These pop-ups claim your Flash Player, browser, or media codec is out of date and must be updated immediately. Clicking the update button downloads an executable that installs Gooodsonline instead of the promised update. Some variants spread through malicious advertisements (malvertising) on legitimate websites, where clicking an ad triggers a download without clear user consent.
Common distribution channels include:
- Bundled freeware installers from sites like Softonic, Download.com, or lesser-known software repositories
- Fake Flash Player or codec updates presented on video streaming or file-sharing sites
- Torrents and pirated software packages that include the hijacker as part of a "cracked" installer
- Malicious browser extensions that appear in search results for popular utilities but are actually Gooodsonline in disguise
- Email attachments disguised as invoices or documents that contain droppers for the hijacker (less common for this family)
- Compromised websites that use drive-by download techniques or exploit kits targeting outdated browser plugins
What It Does On Your Machine
Once installed, Gooodsonline immediately targets your web browsers, which are the primary battleground for this type of threat. The hijacker modifies your homepage, default search engine, and new tab page to point to search.gooodsonline.com or related domains. When you attempt to search using your address bar or visit a search engine directly, your query gets intercepted and routed through Gooodsonline's servers before reaching a legitimate search provider (often a white-labeled version of Yahoo or Bing search). This intermediary step allows the operators to inject advertisements into search results, track which links you click, and generate revenue through affiliate marketing schemes.
The hijacker installs browser extensions or add-ons to maintain control even if you manually change your browser settings back. These extensions often have generic names or masquerade as legitimate utilities. They operate with elevated permissions that allow them to "read and change all your data on the websites you visit"—a permission that enables comprehensive tracking of your browsing behavior. Every search query, every website visited, and every link clicked gets logged and transmitted back to remote servers, building a detailed profile of your interests and habits.
Gooodsonline also modifies browser shortcuts on your desktop, taskbar, and Start menu. If you look at the properties of your Chrome or Firefox shortcut, you'll often see additional command-line parameters appended to the target path, forcing the browser to load the hijacker's homepage on startup. Even if you reset your browser settings through the browser's own interface, launching via these modified shortcuts reinfects your settings immediately.
Beyond search redirection and tracking, this hijacker generates aggressive advertising. You'll see pop-ups, pop-unders, and banner ads inserted into web pages that normally don't contain them. These ads often promote questionable products—fake antivirus software, system optimization tools that are themselves PUPs, browser extensions that are additional hijackers, and occasionally, outright scams. The ad injection slows down page loading times considerably, as your browser must now fetch content from dozens of additional advertising domains for every page you visit. System resources get taxed by the constant network activity and the background processes that monitor your browsing to decide which ads to display.
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your Ethernet cable or disable Wi-Fi to prevent Gooodsonline from continuing to track your activities or potentially reinstalling components during the removal process. This also stops the hijacker from serving ads and communicating with command servers.
Uninstall Suspicious Programs
Open Settings (Windows 10/11) or Control Panel (Windows 7), navigate to Apps or Programs and Features, and sort by install date. Look for unfamiliar programs installed around the time your browser problems started. Common names include variations on "Gooodsonline," generic names like "Web Companion," "Browser Assistant," or completely random character strings. Uninstall anything suspicious, but be cautious not to remove legitimate software—when in doubt, search the program name online before removing.
Remove Browser Extensions
Open each browser you use and navigate to its extensions or add-ons manager (chrome://extensions/ for Chrome, about:addons for Firefox, edge://extensions/ for Edge). Examine every installed extension carefully. Remove anything you don't recognize or didn't intentionally install, paying special attention to extensions with generic names, no reviews, or permissions to "read and change all your data." Gooodsonline extensions often disguise themselves with innocuous names related to shopping, coupons, or productivity.
Reset Browser Settings Manually
In each affected browser, manually change your homepage, default search engine, and new tab page back to your preferred settings. In Chrome, go to Settings > Search Engine and set your default, then check On Startup settings. In Firefox, check Options > Home and Options > Search. Don't rely solely on the browser's "reset" feature yet—verify these specific settings are corrected first. Check for any unwanted search engines listed and remove them.
Fix Modified Browser Shortcuts
Right-click on each browser shortcut (desktop, taskbar, Start menu) and select Properties. In the Target field, remove any text after the .exe filename—the path should end with something like chrome.exe" or firefox.exe" with no additional parameters. If you see --homepage= or similar flags, delete them. Click OK to save. This step is critical because modified shortcuts will reinfect your browser settings every time you launch.
Clean the Registry
Press Windows Key + R, type regedit, and press Enter. Navigate to HKEY_CURRENT_USER\Software and look for any folders named "Gooodsonline" or suspicious random character strings. Delete these keys (right-click > Delete). Also check HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main and verify the "Start Page" value is set to your preferred homepage. Check similar registry locations for Chrome and Firefox policies. Be extremely careful in the registry—deleting wrong entries can break Windows. If you're uncomfortable here, skip to the next step and let scanning software handle it.
Remove Scheduled Tasks
Open Task Scheduler (search for it in the Start menu), expand Task Scheduler Library, and examine the list of scheduled tasks. Look for anything related to Gooodsonline, random character strings, or tasks that run executables from temporary folders or AppData locations. Right-click and delete suspicious tasks. Some hijackers create tasks that periodically reset your browser settings or reinstall components, so this step prevents reinfection.
Scan with Malwarebytes
Reconnect to the internet, download Malwarebytes (the free version is sufficient), install it, and run a full Threat Scan. Malwarebytes excels at detecting PUPs and browser hijackers that traditional antivirus might miss. Quarantine or remove everything it finds. Even if you think you've manually removed Gooodsonline completely, the scan often discovers leftover components or additional PUPs that came bundled with the hijacker.
Reset Browsers to Default (Optional Nuclear Option)
If problems persist after all previous steps, use each browser's built-in reset function. In Chrome: Settings > Advanced > Reset and clean up > Restore settings to their original defaults. In Firefox: Help > More Troubleshooting Information > Refresh Firefox. This will disable all extensions and reset all settings, but preserves bookmarks and passwords. You'll need to reinstall legitimate extensions and reconfigure preferences afterward.
Reboot and Verify
Restart your computer and launch your browsers. Verify that your homepage and search engine remain as you set them and that no unwanted redirections occur when you perform searches. Visit a few different websites and confirm no unexpected ads appear. Monitor for a day or two—some hijackers use delayed persistence mechanisms that don't trigger immediately after removal attempts.
Prevention
- Download software only from official sources. Avoid third-party download sites like Softonic, Download.com clones, and "free software" repositories. Go directly to the developer's website for any program you want to install. If you must use a third-party site, research it thoroughly first.
- Always choose Custom or Advanced installation. Never click through an installer using Express or Recommended settings. Custom installation reveals bundled software and allows you to uncheck optional components. Read every screen carefully and decline any offers for additional software, toolbars, or browser changes.
- Keep your software updated. Enable automatic updates for Windows, your browsers, and plugins like Java and Adobe products. Most hijackers that use drive-by downloads target outdated software with known vulnerabilities. Automatic updates close these security holes without requiring your attention.
- Use a reputable ad blocker. Browser extensions like uBlock Origin (not just "uBlock") block malicious advertisements and prevent many hijacker distribution methods. Ad blockers also improve browsing speed and reduce exposure to scams. Just be sure to download the blocker from official sources—fake ad blockers are themselves sometimes hijackers.
- Be skeptical of update notifications. Legitimate software updates either arrive through the program's built-in updater or Windows Update—not through pop-ups while browsing. If a website claims you need to update Flash, your browser, or a codec, close the page and check for updates through the software's official channels. Flash is actually deprecated and no longer needs updating at all.
- Review browser extensions regularly. Once a month, audit what extensions you have installed. Remove anything you don't actively use or don't remember installing. Browser extensions are a major security risk—minimize the number you keep and verify each one's legitimacy by checking reviews and the developer's reputation.
- Maintain real-time antivirus protection. Windows Defender (now called Microsoft Defender) provides solid baseline protection and is already built into Windows 10 and 11. For additional coverage, consider Malwarebytes Premium running alongside Defender. Real-time protection catches many threats before they execute, including some PUP installers.
- Create a standard user account for daily use. Don't operate as an administrator for routine tasks. Browser hijackers and PUPs have a harder time persisting when installed without administrative privileges. Use an admin account only when installing legitimate software or making system changes, then switch back to your standard account.
Bring It In
Browser hijackers like Gooodsonline are frustrating, persistent, and time-consuming to remove completely. While the manual steps above work when followed carefully, it's easy to miss a component that causes reinfection a week later. Our technicians at Computer Repair Roswell have removed thousands of these hijackers and know every hiding spot, every registry key, and every persistence trick they use. We can typically clean a browser hijacker infection in under an hour, and we'll also check for any additional malware that might have come along for the ride.
If you're dealing with constant redirects, aggressive pop-ups, or browsers that won't stay configured the way you set them, don't waste your weekend fighting with manual removal. Call us at (770) 667-9487 or stop by our shop at 670 Houze Way in Roswell. We're open Monday through Friday 9am-6pm, and we handle most malware removals same-day. Bring your machine in—we'll get your browser back to normal and show you exactly what was causing the problem. No jargon, no overselling, just straightforward repair work from people who actually know what they're doing.