UK security researcher “MalwareTech”, who helped to limit the ransomware attack, predicted “another one coming… quite likely on Monday”.
The virus, which took control of users’ files, spread to 100 countries, including Spain, France and Russia.
In England, 48 NHS trusts fell victim, as did 13 NHS bodies in Scotland.
Some hospitals were forced to cancel procedures and appointments, as ambulances were directed to neighbouring hospitals free from the computer virus.
UK Home Secretary Amber Rudd said on Saturday that the problem was largely resolved but that “there’s always more” that could be done to protect against computer viruses.
NHS trusts that appear to still be experiencing IT difficulties are:
St Bartholomew’s in London
East and North Hertfordshire Trust
James Paget University Hospitals Trust, Norfolk
Southport and Ormskirk Hospital NHS Trust
Lincolnshire Hospitals NHS Trust
York Teaching Hospitals NHS Trust
University Hospital of North Midlands Trust
After taking computers over, the virus displayed messages demanding a payment of $300 (£230) in virtual currency Bitcoin to unlock files and return them to the user.
BBC analysis of three accounts linked with the global attack suggests the hackers have already been paid the equivalent of £22,080.
MalwareTech, who wants to remain anonymous, was hailed as an “accidental hero” after registering a domain name to track the spread of the virus, which actually ended up halting it.