Antivirus Blocking Windows Update: Fix Error 0x80070228

If Windows Update keeps failing with error 0x80070228 — or an update dies seconds after your antivirus pops a "threat removed" alert — the fix is almost always the same. Open your antivirus, go to its Quarantine (Defender calls it Protection history, Norton calls it Security History), restore the flagged Windows files, add a temporary exclusion for C:\Windows\SoftwareDistribution, then reset the update cache and check for updates again. Below are the exact steps for Windows 11 and Windows 10, plus the repair route for the rarer case where no antivirus is involved at all.

The Saturday Jake almost reinstalled Windows over a pop-up

Jake runs a small mobile phone shop, and on slow afternoons he takes in laptops. A customer left him an HP with one complaint: "Windows won't update. It's been trying for three weeks."

Jake did what most of us do. He clicked Check for updates, watched the download crawl to about 40%, and then watched it fall over with "There were some problems installing updates" and the code 0x80070228. He rebooted. Same. He ran Disk Cleanup. Same. By 4pm he had quoted the customer a full Windows reinstall — three hours of labour plus a data backup, call it a lost Saturday and an awkward invoice.

Then Ethan, who has been fixing Windows machines since floppy disks were a backup strategy, asked one question over the phone: "What did the antivirus say, and when did it say it?"

Jake opened Norton's history. There it was: a "threat" detected and quarantined — a file inside C:\Windows\SoftwareDistribution\Download — timestamped within the same minute as every single failed update attempt. The antivirus was shooting the update down mid-flight, every time, and then Windows reported it as a download error because from where Windows stood, the file had simply vanished.

Total fix time once they knew: about eight minutes. No reinstall. Keep that ratio in mind — this error looks like a broken Windows and is usually a five-minute misunderstanding between two pieces of software that are both technically doing their jobs.

What 0x80070228 actually means — and what it doesn't

Windows error codes look like gibberish, but the first half of this one is genuinely informative. Any code starting with 0x8007 means: Windows Update itself didn't fail — it's passing along a general Windows error that happened underneath it. The last digits identify the low-level error. In this family you'll also meet 0x80070002 (file not found) and 0x80070005 (access denied), and they all share one story: something outside the updater interfered with a file operation.

Here is the part most pages get wrong, so let's say it plainly. Several popular articles claim 0x80070228 means "the Windows Update service is disabled." It doesn't — that's 0x80070422, a different code with a different fix. Following that advice sends you to services.msc to toggle a service that was never the problem, which is exactly how people end up reinstalling Windows over a pop-up.

What the case history actually shows — going back to the March 2017 wave that this very article originally covered, when Norton's cloud engine started flagging freshly downloaded Windows files as Suspicious.Cloud.7.F — is that 0x80070228 almost always appears when security software yanks a file out from under the updater mid-download or mid-install. Windows asks for a file it just wrote, the file is gone (quarantined), and the update collapses with a generic file error.

Why would an antivirus flag Microsoft's own files? Because modern antivirus doesn't only match known viruses — it uses heuristics and cloud reputation. A brand-new update file is, by definition, a file the reputation system has never seen: new hash, freshly written to disk, sometimes executable. To a suspicious heuristic, "never seen before + just appeared in a system folder" can look like an infection. That's a false positive, and every vendor — Norton, McAfee, Avast, Bitdefender, even Microsoft's own Defender on rare occasions — has had waves of them.

The one-question diagnostic: did your antivirus flag something?

Before touching anything, answer one question: in the minutes around the failed update, did your security software log a detection? The answer decides which of two routes you take, and checking takes under a minute.

If you use Microsoft Defender (no third-party antivirus)

Open Windows Security — press Win and type Windows Security — then go to Virus & threat protection > Protection history. This is Defender's diary: every detection, quarantine, and blocked action, timestamped. Look for entries whose time matches your update failure and whose file path includes C:\Windows\SoftwareDistribution or C:\$WINDOWS.~BT (the hidden folder Windows uses for feature-update staging).

If you use Norton, McAfee, Avast, Bitdefender or similar

Open the program and find its history or quarantine screen. The wording varies — Norton calls it Security History, McAfee has a Quarantined items list, Avast and AVG call it Quarantine (previously "Virus Chest"), Bitdefender lists it under Notifications and Quarantine — but every product has both a log and a holding cell. Same test: a detection timestamped alongside the update failure, with a file path inside a Windows system folder.

One subtlety worth knowing: when a third-party antivirus is installed, Defender switches its own real-time protection off to avoid two engines fighting over the same files. So check the product that's actually on duty — if Norton is installed, Defender's Protection history will be quiet even while Norton is quarantining update files hourly.

Found a matching detection? Take Route 1, right below. Nothing logged anywhere? Your problem isn't antivirus interference — skip to Route 2 and repair the update pipeline instead.

Route 1: your antivirus flagged update files

Five steps, in this order. The order matters — if you reset the update cache before restoring the quarantined file, the antivirus will usually flag the re-downloaded copy again and you'll conclude the fix "didn't work."

Step 1 — Restore the file from quarantine

Quarantine is not deletion. It's an encrypted holding cell: the file is scrambled, moved aside, and rendered harmless, but fully recoverable. Restoring a file you have judged to be a false positive is safe and reversible — if you're wrong, the antivirus will simply flag it again.

Defender: in Protection history, click the relevant entry, then Actions > Restore. You may be asked for administrator approval — that's the blue-and-yellow shield prompt, and it's expected.

Third-party products: open Quarantine, select the item, choose Restore (Norton: Options > Restore this file from Security History; Avast: right-click the item in Quarantine > Restore; McAfee: select in Quarantined items > Restore). If the product offers "Restore and exclude" in one action, take it — it saves you Step 2.

Step 2 — Add a temporary exclusion

An exclusion tells the antivirus "don't scan this location." You're adding it so the next download attempt survives long enough to install. In Defender: Windows Security > Virus & threat protection > Manage settings (under "Virus & threat protection settings") > Exclusions > Add or remove exclusions > Add an exclusion > Folder, then pick C:\Windows\SoftwareDistribution. In third-party products the setting lives under names like Exclusions, Exceptions, Allowed items or Scan exclusions, always somewhere in Settings.

If your failure happens during a big feature update (the once-a-year version jump, like moving to Windows 11 25H2) rather than a monthly patch, also exclude C:\$WINDOWS.~BT — that's where setup stages the new operating system, and it's a folder heuristics love to panic about, because it appears from nowhere and fills with gigabytes of executables.

Step 3 — Reset the Windows Update cache

The failed attempts have left half-downloaded, possibly mangled files in the cache. Clearing it forces Windows to start clean. You'll do this in an administrator terminal — right-click the Start button and choose Terminal (Admin) on Windows 11, or Windows PowerShell (Admin) on Windows 10. Then run these lines one at a time, pressing Enter after each:

net stop wuauserv
net stop bits
net stop cryptsvc
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start cryptsvc
net start bits
net start wuauserv

What each line does, since typing commands blind is how mistakes happen: net stop pauses a background service — wuauserv is the Windows Update service itself, bits is the Background Intelligent Transfer Service that handles the actual downloading, and cryptsvc verifies that downloaded files are genuinely signed by Microsoft. ren renames the two cache folders instead of deleting them — Windows rebuilds fresh ones automatically, and if anything goes sideways you still have the originals. The three net start lines switch the services back on.

If a rename fails with "access denied," a service is still holding the folder — make sure all three net stop lines reported success (a reboot first also clears any lock). After a week of successful updates, the .old folders are safe to delete to reclaim a few gigabytes.

Step 4 — Retry the update

Go to Settings > Windows Update (Windows 11) and click Check for updates. The download restarts from zero — the cache you just cleared held the partial copies, so a full re-download is expected, not a sign of failure. With the file restored and the exclusion in place, the update should now sail through. On the machines we tested, the previously stuck update installed on the first retry.

Step 5 — Report the false positive, then remove the exclusion

Two cleanup jobs. First, report the false positive to your antivirus vendor — every major vendor has a submission page (search "your product submit false positive"), and reports are what get the bad detection signature pulled for everyone else. Second, once the update shows as installed, go back into your antivirus and delete the exclusion you added in Step 2. It has done its job.

Route 2: nothing was flagged — repair the update pipeline

If every quarantine and history screen is empty, the file that vanished mid-update was lost to something duller: a corrupted cache, a damaged system file, or a service misbehaving. Work through these in order — each step is bigger than the last, and most machines never need the later ones.

First: the Windows Update troubleshooter

On Windows 11, open Settings > System > Troubleshoot > Other troubleshooters and run Windows Update — on current builds this hands off to the Get Help app, which walks through the same repairs interactively. It resets the most common cache and service faults automatically, and takes two minutes. Unglamorous, genuinely worth doing first.

Second: the cache reset

Run the same eight-command cache reset from Route 1, Step 3 — it's just as valid when no antivirus is involved, because it also clears corrupted partial downloads, which are the other classic cause of mid-download file errors.

Third: repair the system files with SFC and DISM

Two built-in repair tools, run from the same administrator terminal. SFC (System File Checker) compares every protected Windows file against a known-good copy and repairs mismatches. DISM repairs the component store — the master library SFC repairs from. Run them in this order:

sfc /scannow
dism /online /cleanup-image /restorehealth

SFC takes five to fifteen minutes; DISM can take longer and its progress bar famously sits at 62% for ages — that's normal, let it finish. If SFC reports "found corrupt files and successfully repaired them," run it once more until it comes back clean, then retry the update.

Fourth: install the update manually from the Update Catalog

Every Windows update has a KB number ("Knowledge Base," e.g. KB5101650) shown next to the failing item in Windows Update. Copy that number into catalog.update.microsoft.com — Microsoft's plain, no-frills warehouse of every update ever shipped — download the version matching your system type (x64 for nearly everyone), and double-click the file to install it. This sidesteps the download half of the pipeline entirely, which both fixes the immediate problem and confirms the diagnosis: if the manual installer also fails, your issue is in the installing, not the downloading.

Last resort that isn't scary: repair-reinstall Windows in place

Windows 11 has a remarkably civilised nuclear option: Settings > System > Recovery > Fix problems using Windows Update. It re-downloads and reinstalls the current build of Windows over itself — keeping your files, apps and settings — and replaces every system file in the process. It needs a working internet connection and 30–90 minutes. On Windows 10, the equivalent is mounting an installation ISO from Microsoft's download site and running setup with "Keep personal files and apps" selected. Either way, this rebuilds the entire update machinery and resolves the cases nothing else touches.

The same fix on Windows 10

Every command and every antivirus step above is identical on Windows 10. Only the menu geography differs: Windows Update lives at Settings > Update & Security > Windows Update, the troubleshooter at Settings > Update & Security > Troubleshoot > Additional troubleshooters, and Windows Security is the same app with the same Protection history screen.

One thing to rule out before blaming your antivirus at all: Windows 10's free updates ended on 14 October 2025. If your Windows 10 PC gets no updates whatsoever — no failures, just silence — that's not an error, that's end of support. The fix is enrolling in Extended Security Updates (ESU) via the "Enroll now" link in Settings > Windows Update: free if you sync settings with Windows Backup, or 1,000 Microsoft Rewards points, or a one-time fee of roughly $30. Microsoft extended consumer ESU in June 2026, so coverage now runs to October 2027 and enrollment is still open. Error 0x80070228 on an ESU-enrolled machine, though, means the update pipeline is genuinely failing — and both routes above apply unchanged.

Worth saying while you're here: if the machine qualifies for Windows 11 (Settings > Update & Security > Windows Update will offer it, or the PC Health Check app will tell you why not), the upgrade is still free and moves you back onto fully supported ground — ESU is a bridge, not a destination.

The hard cases

The antivirus deleted the file instead of quarantining it

Some products, on high-confidence detections, skip quarantine and delete. There's nothing to restore — but nothing is lost either, because everything in the update cache is re-downloadable. Add the exclusion (Route 1, Step 2), run the cache reset, and retry: Windows fetches a fresh copy. If the deletion hit an installed system file rather than a cached download — symptoms include other things misbehaving, not just updates — run the SFC and DISM pair from Route 2 to rebuild what was removed.

It happens again every single Patch Tuesday

Once is a false positive; every month is a pattern. Three things to check. First, make sure the antivirus itself is up to date — vendors usually pull a bad signature within days, and a product that can't update its own definitions keeps re-flagging forever. Second, look for a setting scanning downloads aggressively (names like "reputation-based blocking of uncommon files" or "hardened mode") and relax it one notch. Third, if a specific product keeps quarantining Windows files month after month while its vendor shrugs, that is the product telling you what it thinks of your time — Ethan's view on replacements is two sections down.

You uninstalled the antivirus and the error survived

Third-party antivirus digs in deep — filter drivers, services, boot hooks — and the standard uninstall routinely leaves debris behind that keeps intercepting file operations. Every major vendor publishes a dedicated removal tool for exactly this: Norton's Remove and Reinstall tool, McAfee's MCPR, Avast Clear, Bitdefender's uninstall tool. Run the vendor's tool, reboot, then do the cache reset again. If the error still stands after a genuinely clean removal, you were in Route 2 territory all along — go do SFC and DISM.

It's an Insider Preview build

This article began life in March 2017 as a fix for exactly that — error 0x80070228 while downloading Insider build 15048, during a wave of Norton false positives. Insider builds make antivirus interference more likely, because pre-release files have zero cloud reputation. The routes above apply unchanged; the extra advice is to run Insider machines on plain Defender, and to remember that a failed flight sometimes isn't your fault at all — Microsoft pulls and reissues builds. (The Insider Program itself was restructured in spring 2026: the old Dev and Canary channels are gone, replaced by Beta, Experimental and Release Preview.) We documented the same code on build 15055, plus the neighbouring failure modes: a build that never starts downloading, error 0xC1900401 with "build not yet available", and install failures with error 8024a112.

The boring causes worth thirty seconds

Before deep surgery, rule out the mundane. Disk space: a monthly update wants a few gigabytes free, a feature update wants 20+ — check Settings > System > Storage and run cleanup if the C: drive is nearly full. Metered connection: if your Wi-Fi is marked metered, Windows politely refuses large downloads — Settings > Network & internet > your network > toggle off "Metered connection." A work-managed PC: if the machine says "Some settings are managed by your organization," update behaviour may be policy-controlled and your IT department is the fix, not this article.

Do you even need that third-party antivirus?

Jake asked Ethan the question directly: "So do I tell my customer to bin Norton?"

Ethan's answer, which is also this site's answer: for most home users on Windows 11, Defender is enough. It ships with Windows, scores consistently well in independent lab tests, updates itself through the same pipeline it protects, and — relevantly for this article — it is the engine least likely to quarantine Windows' own update files, because Microsoft tests its detections against its own updates before shipping either.

That is not an even both-sides summary, so here is the other side stated fairly: a paid suite still earns its keep in specific situations. Jake's shop machine plugs in strangers' USB sticks all day and handles customer data — a hardened product with device control is a reasonable buy there. Households who click first and ask later benefit from the aggressive web-filtering the paid products bundle. But if you're paying yearly for an antivirus on a machine one careful adult uses, that money is better spent on a backup — an external drive or a cloud backup plan. A backup rescues you from the one category of disaster no antivirus prevents: your own storage dying. Jake now says this to customers weekly, ever since a dead laptop drive cost one of them ten years of family photos that no security suite could have saved.

What our 2017 article got wrong — and what it got right

This page originally told readers to exclude six specific files — p2p.dll, fxsext32.dll, searchfolder.dll, sti.dll, joy.cpl, msident.dll — because those were the exact files Norton's Suspicious.Cloud.7.F detection was quarantining out of builds 15046 and 15048 in March 2017. For that week, on those builds, it was correct, and we were writing it while the forums were still arguing about the cause.

As lasting advice it aged badly, and we'd rather say so than quietly pretend otherwise. A fixed list of file names is useless for the next false-positive wave, which will flag different files. Our old page also suggested uninstalling the antivirus as an early step — wrong order; restore-and-exclude preserves your protection and is faster. And we misspelled SoftwareDistribution as "softwaredisturubtion," which anyone typing the path verbatim discovered the hard way. What the 2017 post got right is the part this rewrite keeps: the diagnosis. When Windows Update fails with a file error the instant your antivirus logs a detection, believe the timestamps, not the error code.

FAQ

What does error 0x80070228 mean in Windows Update?

The 0x8007 prefix means Windows Update is reporting a general Windows file-operation error rather than an update-specific one. In documented cases it almost always means something — usually security software — removed or blocked an update file mid-download. It does not mean the Windows Update service is disabled; that's error 0x80070422.

Can antivirus software really block Windows Update?

Yes. Antivirus heuristics judge new files partly by reputation, and freshly downloaded update files have none — new hash, just written into a system folder. A cautious engine can quarantine them as suspicious, and Windows then fails the update with a file error because the file it just downloaded has vanished.

Is it safe to restore files from antivirus quarantine?

For this scenario, yes. Quarantine is reversible by design — the file is neutralised, not destroyed. Restore is safe when the file path is inside C:\Windows\SoftwareDistribution or C:\$WINDOWS.~BT and the timestamp matches a Windows Update attempt. If the restored file were genuinely malicious, the antivirus would flag it again immediately.

Should I keep SoftwareDistribution excluded permanently?

No. Add the exclusion to get the failed update through, then delete it once the update installs. A permanent exclusion is a permanent blind spot, and update folders are a known hiding place for real malware precisely because people exclude them.

Do I have to uninstall my antivirus to install Windows updates?

Almost never. Restoring the quarantined file and adding a temporary exclusion fixes the overwhelming majority of cases with protection still running. Uninstalling — with the vendor's dedicated removal tool, not just the standard uninstaller — is the fallback for products that keep interfering after a proper exclusion.

What is the SoftwareDistribution folder and can I delete it?

It's the Windows Update working directory — downloaded update files, logs and metadata live there. Its contents are safe to clear when the update services are stopped; Windows rebuilds the folder automatically. Renaming it to SoftwareDistribution.old, as in the steps above, is the safer version of deleting it.

Will resetting the Windows Update cache delete my personal files?

No. The reset only touches C:\Windows\SoftwareDistribution and the catroot2 signature cache — both are plumbing for updates. Documents, photos, apps and settings are untouched. The only visible effect is that pending updates re-download from zero.

Does this fix work on Windows 10 as well as Windows 11?

Yes — every command and antivirus step is identical. Only menu paths differ: Windows 10 keeps Windows Update under Settings > Update & Security. Remember that Windows 10 needs ESU enrollment to receive updates at all now; a machine that isn't enrolled gets silence, not error codes.

What if the error comes back after every monthly update?

A repeating monthly failure means your antivirus is re-flagging each new update. Update the antivirus itself first — vendors fix bad signatures quickly — then relax any "block uncommon files" hardening setting. If a product keeps quarantining Windows files for months, replacing it with Defender is a legitimate fix.

How do I report a false positive to my antivirus vendor?

Every major vendor runs a submission portal — search for your product's name plus "submit false positive." You upload the file or its detection name; the vendor re-analyses it and, if it's clean, pulls the signature in a definitions update. Reporting is what stops the same file being flagged on millions of other PCs.

Is Microsoft Defender enough, or do I need a paid antivirus?

For most home users on Windows 11, Defender is enough — it's built in, well-rated in independent tests, and least likely to fight Windows Update. Paid suites make sense for higher-risk use: machines handling strangers' devices, or households needing aggressive web filtering. If the budget is fixed, buy backup before antivirus.

What if Windows Update fails with a different error code?

The diagnostic still applies: check Protection history first, because antivirus interference produces several codes, not just this one. For codes with other causes we've covered separately — upgrade errors like 0xca00a000, downloads that never start, or updates that hang for hours — see the related posts below.

Keep this bookmarked next to it

Revision note. Originally published 4 March 2017 as a fix for error 0x80070228 on Windows 10 Insider build 15048, during the Norton Suspicious.Cloud.7.F false-positive wave. Rewritten and re-tested 1 August 2026 on Windows 11 25H2 (build 26200.8875) and Windows 10 22H2 as the evergreen guide to antivirus-blocked Windows updates. Reversed from the original: we no longer recommend uninstalling your antivirus as an early step — restore-from-quarantine plus a temporary exclusion is faster and keeps protection running; the 2017 list of six file names to exclude was specific to that wave and has been retired.In Short, we had updated for latest changes