A global cyber attack appears to be dying down, after spreading to 104 countries and locking up the files on at least 45,000 computers.

However, experts are warning there could be a new wave of problems when people go back to work tomorrow.

Researchers believe spying tools developed by the US National Security Agency were used in the attack that hit international shipper FedEx, disrupted Britain's health system and forced a European carmaker to halt some production lines. 

Exploiting a flaw in older Microsoft operating systems, cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files yesterday.

The ransomware encrypted data on the computers, demanding payments of $US300 to $US600 to restore access.

Researchers with Czech Republic-based security software maker Avast said 60 per cent of infected computers were located in Russia, followed by Ukraine and Taiwan.

Neither the NCSC or National Computer Emergency Response Team have received any reports that Kiwis were targeted.

Cyber security expert Bill Buchanan says going forward, users can save themselves a lot of grief by taking simple security steps.

"Normally ransomware comes through phishing emails so obviously we need to inform staff that they shouldn't be clicking on anything that looks malicious. Certainly backups are a key focus," he said.

Microsoft says it has now released patches for operating systems now out of customer support periods, that will update Windows XP, Windows 8 and Windows Server 2003.

Microsoft says releasing the patches recognises and helps the many users who still have machines with its earlier operating systems and will protect computers not already affected.

Britain's health system has recovered from the disruption, with 97 per cent of the country's health service trusts now "working as normal", Interior Minister Amber Rudd says.

Speaking after chairing a meeting of the crisis response committee, or COBRA, Rudd said 48 of 248 health service trusts in England had been impacted by the attack, but that all except six were now functioning normally.

"The response has in fact been very good," she said. "We think we have the right preparedness in place and also the right plans going forward over the next few days to ensure that we limit its impact going forward."

Earlier, Rudd said the government did not know who was behind the attack.