Yes this is normal, i suppose you added an exclusion in the settings section which only excludes from on demand scans, to exclude from realtime this has to be done in file system shield and depending on what it is your excluding maybe even the auto sandbox and behaviour shield.