UPDATED 8.26PM The death toll from the car attack on pedestrians in Melbourne's CBD has risen to five, with a three-month-old baby dying in hospital.

Police confirmed the boy's death late on Saturday night and said four people remained in a critical condition in hospital after the incident on Friday afternoon.

A 10-year-old girl, 25-year-old man and a woman, 32, died at the scene after the car driver sped along Bourke Street Mall and a 33-year-old man died in hospital on Friday night.

Hospitals have treated 37 other people injured in Friday's carnage.

Among those reported to be hospital are the mother and sister of the 10-year-old girl, who died.

Community members have banded together to donate funds to the girl's family.

"This is a family like any of ours," Avi Yemini wrote on a crowdfunding page.

"The public space where they were so terrorised, is a space which belongs to every single one of us."

As the shock of the tragedy set in, hundreds visited Bourke Street Mall to pay their respects.

Floral tributes were building on the corner of Bourke and Elizabeth streets, many leaving notes along with bouquets.

First responder Sharon Carpenter made the effort to come on Saturday a day after she rushed to help those injured outside her workplace.

"I didn't want to sit around the house," she said.

"I wanted to come today and put some flowers down."

A three-month-old baby is one of several critically injured, while the accused killer, Dimitrious "Jimmy" Gargasoulas, also recovers in hospital.

He was arrested after police shot him in the arm and blocked his way.

Victorian Police Commisioner Graham Ashton said that police hoped to interview and charge the 26-year-old sometime this weekend after he had surgery to his arm.

Before the Bourke Street attack, Gargasoulas had allegedly stabbed his brother Angelo early in the morning, taken his girlfriend hostage before she escaped from his car, then began driving erratically around Melbourne, doing doughnuts around Flinders Street Station.

The Victorian State Coroner, Sara Hinchey said a coronial investigation will begin immediately to examine all aspects of the incident.

Gargasoulas's mother, Emily Gargasoulas, told reporters she was ashamed to be his mum.

'I couldn't believe it... it make me feel sick," she said.

She also apologised, saying she was "so so sorry".

The victims:

-Thalia Hakin - 10, died in the attack. Her mother and sister were injured and remain in hospital
-Matthew Si - a 33 year old father
-Jess Mudie - 22
-A 25-year-old man and three-month-old boy yet to be named

-Hospitals treated 37 other people injured during the incident. Four remain critical.
-The 27-year-old driver was shot by officers and taken to hospital under police custody. He has undergone surgery for wounds to the arm. 

The driver has been linked to a stabbing in Windsor early on Friday which left his brother in a critical condition.