I'm not completely sure what you're trying to say, but I think you should check the settings of the File System Shield.
Executable files are not scanned "on read" by default, only "on execute" and "on close" - and scanning on close is done after the file is written to the target location, so if you choose block (and not e.g. delete), it will be there.
So yes, it's normal.