Hi, I mostly deal with cheaters on my shard, and I've started receiving the log files on occasion. I'm trying to decode some of the information:

<char> speaking with out-of-range color 0x7620 - I've seen some injection users using a weird yellow text that shows up in the journal as no character speaking, and i'm wondering if this has anything to do with it?

Also: suspected stealth/injection user often gives this message: <account> sent non-allowed message type 34

and, well, is there anything to look for in the logs that might give away injection users? I know about 80% of my server uses it and it's frustrating to the honest players :/ Any help would be great, thanks.

AFAIK you cant detect injection in general. You just can detect some it signs. F.e. it sends much more resync requests than pure client.
May be implementing encrypted connections will solve this problem. AFAIR inject do not support new clients encryption. But may be a'm wrong.

Injection does support ALL 2d clients, so thats not a way to stop it.

The only ways to stop it is either modify the client.exe to fill something special in some packets and use that to find out if the player is using injection or not ( for example 0x80 login packet fill all the 30 bytes of password or acctname and then on serverside clean it up )

Other way is to make a client launcher ( works similar to injection ) and have that control the client totally and use some packets to recognize it on the server side.

Or custom encryption which is the most hard task to do of these 3.

Yoko wrote that inject does not support clients higher than 4. In ignition mode (no crypt) may be it will work but i'm not sure it will work with 5.* & 6.* clients with native encryption.
If its true will be enough disable using clients with encryption disabled and clients < = 4.0.