You are receiving a popup as below, and don't understand why you are receiving a Quarantine Message as you do not have it enabled. And want to prevent it from occurring.
Release : 15.8
Component : Endpoint Prevent
The difference in the messaging you are experiencing is the difference between copying a file to a USB drive or trying to save a new file to the USB drive.
Copy an existing file and you get:
However, if you open a program, create something and try to save it to the USB drive you get.
You also get the same behavior if you use the save as dialog and select the USB drive.
Working as designed
This is expected behavior because if a file is being created, and we block it then the file would be gone with no way to recover it.
Therefore when the save as dialog is used and we block the operation we quarantine the file so that it can be recovered.
You can customize the quarantine message in the agent configuration > Advanced Settings by changing the value of UI.QUARANTINE_PROMPT.str
You can customize the quarantine location in the agent configuration > Settings by changing the default path located under File Recovery Area Location.
The same behavior will be observed when creating a file on a network share and it is blocked.
More detail can be found in
How Does the DLP Endpoint Agent Block Data in Motion Requests(USB and Network monitor)