klif.sys can be related to Kaspersky anti-virus - see here
Determining whether a file is malware or a legitimate process sometimes depends on the location
(path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file. However, it then places itself in a different location (folder) than where the legitimate file resides and runs from there. Do you now or have you ever had a Kaspersky product installed on your system?