Raff expects that Carberp will follow in the footsteps of the SpyEye and Siberia attack kits, and like them, incorporate links to a scanning service.

Last week, Raff that described new features other than the antivirus polling, including encryption of all communication with the hacker command-and-control server.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at or subscribe to . His e-mail address is .

in Computerworld's Malware and Vulnerabilities Topic Center.