This is needed for cross-domain-tracking (i.e. track people who cross domain boundaries as one visitor and not as one visitor per domain). If you want cross domain tracking you cannot remove this. The _ga - part is the client id which identifies a session and since it cannot be shared via cookies (which are domain specific) it has to be passed via the url when the domain changes.

Since somebody set your site up for cross domain tracking I guess you actually want this (it does not happen by default). The parameter is a necessary side effect of cross domain tracking with Universal Analytics. If you do want this look in the tracking code for any of the linker functions mentioned in the documentation and remove them.

Updated to answer the questions from the comment.

1. Is there no way to remove the _ga string and still have the cross domain facility?

   No, currently not. Browser vendors work on better ways of cross domain communication so there might be something in the future, but at the moment the parameter is the best way.

2. Also, what if some user randomly changes the _ga value and presses enter? How will GA record that?

   If the user happens to create a client id that has been used before (highly unlikely) his visit would be attributed to another user. Realistically Google Analytics will just record him as a new user.

Updated

For those who like to play I did a proof of concept for cross domain tracking without the _ga parameter. Something along those lines could be developed further, as-is it is not suitable for production use.

Update: David Vallejo has a Javascript solution where the _ga parameter is removed via the history API (so while it is still added it is for all intents and purposes invisible to the end user). This is a more elaborate version of Michael Hampton's answer below.