I just solve the problem.
In my side, I find that it was a background process of Viber. which want root permission, it can be a bug from Viber. May be first time I allow that access, I dont remember, as a result there is no way to block this from 'Super User'. Because Superuser dont show any...