Malwarebyte app found two malware in the firrmare locate at:
1) /system/vendor/operator/app/service/service.apk -> able to remove/uninstall
2) /system/priv-app/funnew_4944_#2015000778#_#2015000780#new_sign.apk -> not able to remove because i live in priv-app directory ....
the malware cause popup advertisement in the web browser every time a web page is open ....