([A-Z]{3})\s+([\w|\s]+)\,\s*([\w|\s]+) Should work based on the data you supplied, the first group looks for exactly three characters (from A to Z), then some whitespace.  The second group looks for word characters or whitespace in sequence until it hits a comma.  The third group looks for word characters or whitespace until it hits the end of line.

You cant use any usermode libs or dlls in a kernel mode driver. You can use ntoskernel.exe, hall.dll, ndis.sys and so on. Truth is the subjection of reality to an individuals perception