My guestbook version 2.4.3 has been hacked

OK - I have found that. It says
[base_url]/image.php?id=$VARS[gbtoken]"
So i understand what to insert in between the '', but please could you explain what I am doing before I do this!
On add an entry, the letters come up that a user has to copy already. I looked up 'captcha' and it seems that it what it is. So if it already working, do I still need to do what you suggest, or is there another benefit?
thanks

That's definitely no right. Your config file appears to have gotten messed up. Can you email it to me? Either use the forums email system or send it to webmaster@carbonize.co.uk