I received an alert from the Network Threat Protection / IPS that I have never seen before and don't entirely understand....

Application has changed since the last time you opened it, process id: 5152 Filename: C:\Program Files\Java\jre6\bin\java.exe The change was allowed by profile. ---- Modules changed: 1 ---- C:\Program Files\Java\jre6\bin\java.exe ---- New modules: 0 ----

At first I thought it was just a new version of Java had been installed on the computer.  But in the alert message the remote IP address is 212.95.55.185.  A quick search of Google shows that this site is blacklisted.   So now I am wondering if the web site 212.95.55.185 changed the Java executable?

Also at the exact same time another IPS alert says that [SID: 23495] HTTP Acrobat PDF Suspicious File Download 6 detected in IE from the same remote IP address.

Should I be concerned that Java.exe is infected?