Thanks for your help, I ran hijackthis but the logs were clean (no suspicous software, nameserver in the tcp-ip settings was not redirected, no...
I was spoofed from a Google-Search to 85.255.115.221 (instead of produkte24.com) and FF started popping up a Window which wanted to "search for...
Separate names with a comma.