ErrorBase
Independent technical referenceOfficial site
  • Software and digital services
  • Operating system

0x80240038

Microsoft Windows Update 0x80240038: invalid file type

Verified with sources1 sourceReviewed Oct 19, 2026
Technician coming? See the 3 steps they must show you

Risk level

Medium

Proceed carefully and stop if the check is unclear.

Urgency

Medium

Quick answer

Windows Update error 0x80240038 (WU_E_WINHTTP_INVALID_FILE) means the downloaded file has an unexpected content type. Check your WinHTTP proxy settings with netsh winhttp show advproxy, verify that no web filter or captive portal intercepts downloads, and save WindowsUpdate.log.

Safety first

Stop and check this first

  • Do not run sc.exe sdset to overwrite security ACLs on the BITS and Windows Update services during a first reset attempt; Microsoft warns that this command overwrites existing security descriptors and should be skipped unless all other reset steps have failed.
  • Never permanently stop or disable the Windows Defender Firewall service or install update packages from unofficial websites; Microsoft states that stopping the Windows Firewall service is not supported and requires backing up personal files before running advanced command-line repairs.

Safe checks you can perform

  • Inspect active WinHTTP system proxy settings with netsh winhttp
  • Verify clean network connectivity and check for captive portals or web filters
  • Locate the rejected download URL in WindowsUpdate.log with Get-WindowsUpdateLog
  • Run the Windows Update troubleshooter to clear stuck 0x80240038 transfers

Leave these tasks to a qualified professional

  • Do not attempt this professional task: Configure WinHTTP proxy settings and allow HTTP RANGE requests to Microsoft Update endpoints
  • Do not attempt this professional task: Reset SoftwareDistribution\DataStore, Download, and catroot2 caches from an elevated prompt
  • Do not attempt this professional task: Install the affected KB manually from the official Microsoft Update Catalog

What a technician must be able to justify

Technician visit

These are the steps they must carry out and show you. Tick them as they work: if steps are skipped, do not accept a part swap.

These are not instructions for opening or handling the equipment yourself. They are the checks that should support a technical conclusion.

  1. Configure WinHTTP proxy settings and allow HTTP RANGE requests to Microsoft Update endpoints

    What they doHave the network or IT administrator align WinHTTP proxy settings using netsh winhttp, permit HTTP RANGE requests (RFC 7233), and exempt *.download.windowsupdate.com, *.dl.delivery.mp.microsoft.com, *.delivery.mp.microsoft.com, and *.windowsupdate.com from web-filter HTML rewriting or proxy authentication challenges.

    They must show youthe netsh winhttp configuration output and a network trace confirming HTTP 200/206 binary responses from the update endpoint without HTML interception.

    In writingthe firewall or proxy exception rules added for the Windows Update endpoints and the applied WinHTTP proxy setting.

  2. Reset SoftwareDistribution\DataStore, Download, and catroot2 caches from an elevated prompt

    What they doOnce the network path returns valid binary payloads, have an administrator back up personal files, open an elevated Command Prompt, run net stop bits, net stop wuauserv, and net stop cryptsvc, rename %Systemroot%\SoftwareDistribution\DataStore, %Systemroot%\SoftwareDistribution\Download, and %Systemroot%\System32\catroot2 to *.bak, and restart the services with net start.

    They must show youthe elevated Command Prompt session showing services stopped, folders renamed to .bak, services restarted, and a clean update download.

    In writingthe list of folders renamed, the timestamp of the cache reset, and the KB numbers that installed afterward.

  3. Install the affected KB manually from the official Microsoft Update Catalog

    What they doIf a single update package continues to fail over WinHTTP while proxy rules are being remediated, have the administrator search the KB number in the Microsoft Update Catalog, download the standalone package, and double-click it to install.

    They must show youthe downloaded package from the Microsoft Update Catalog and the installed KB entry in Windows Update history.

    In writingthe installed KB identifier, package filename, and resulting OS build number.

Before accepting a part or repair

Nothing has been shown yet. Do not accept a part swap based on the code alone.

Follow these steps

Note: Follow the documented order. An error code identifies the affected system, but it does not prove by itself which part has failed.

  1. Inspect active WinHTTP system proxy settings with netsh winhttp

    Tools required

    Who:
    You or your IT administrator in Command Prompt or PowerShell.
    How:
    Open Command Prompt and run netsh winhttp show advproxy (and netsh winhttp show proxy) to inspect whether system-level WinHTTP traffic is routed through a proxy server.
    Result that matters:
    Windows Update uses WinHTTP for update transfers, which has proxy settings separate from user-level browser settings.
    If netsh winhttp shows an outdated, unknown, or authenticating proxy server, that points to the proxy intercepting the download and returning an HTML page that triggers WU_E_WINHTTP_INVALID_FILE.
    If WinHTTP shows direct access on a home network with no proxy configured, that rules out a local WinHTTP proxy table misdirection.
    Evidence to keep:
    Save the exact text output of netsh winhttp show advproxy.

    Do not run netsh winhttp reset proxy on a corporate workstation without checking with your network administrator first.

    Evidence: How Windows Update works · Windows Update issues troubleshooting · Netsh.exe commands - Win32 apps

  2. Verify clean network connectivity and check for captive portals or web filters

    No special tools

    Who:
    You signed in on the affected Windows PC.
    How:
    Check Start > Settings > Network & Internet > Wi-Fi or Ethernet, disconnect any non-essential VPN, and open a browser window to confirm the network does not redirect requests to a captive sign-in page or web filter notice.
    Result that matters:
    Microsoft notes that firewalls or web filters (such as Lightspeed Rocket or proxy filters) that filter downloads can cause the Windows Update client to receive incorrect responses.
    If the network redirects HTTP traffic to a captive login portal or corporate block page, that confirms why WinHTTP received an unexpected content type on 0x80240038.
    If ordinary connections reach Microsoft endpoints without redirection, that rules out a basic captive Wi-Fi portal.
    Evidence to keep:
    Record the active network profile, VPN state, and a screenshot of any proxy or filter warning.

    Evidence: Common Windows Update errors · Microsoft Windows Update troubleshooting · Windows Update issues troubleshooting

  3. Locate the rejected download URL in WindowsUpdate.log with Get-WindowsUpdateLog

    Tools required

    Who:
    Your IT administrator or an advanced user in Windows PowerShell.
    How:
    Run Get-WindowsUpdateLog in PowerShell to generate a static WindowsUpdate.log file from C:\Windows\Logs\WindowsUpdate, then search for 0x80240038 alongside DownloadManager and ProtocolTalker entries.
    Result that matters:
    DownloadManager creates and monitors payload downloads and logs the specific endpoint URL (Windows Update CDN or intranet WSUS) that returned the invalid file.
    If the log shows 0x80240038 against a specific *.download.windowsupdate.com, *.delivery.mp.microsoft.com, or WSUS URL, that isolates the exact host whose HTTP response content type is being altered or rejected.
    If only one specific KB URL fails while other updates download normally, that points to that individual package on the update server rather than a network-wide proxy block.
    Evidence to keep:
    Keep the WindowsUpdate.log lines showing the timestamp, DownloadManager component, URL, and 0x80240038.

    Share only the relevant WindowsUpdate.log lines with network support after redacting internal usernames if present.

    Evidence: How Windows Update works · Windows Update log files · Windows Update issues troubleshooting

  4. Run the Windows Update troubleshooter to clear stuck 0x80240038 transfers

    No special tools

    Who:
    You logged in as a local administrator on the PC showing 0x80240038.
    How:
    Select Start > Settings > System > Troubleshoot > Other troubleshooters, locate Windows Update, and select Run (on Windows 10: Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update > Run the troubleshooter).
    Result that matters:
    Microsoft recommends running the built-in Windows Update troubleshooter first to analyze the queue and reset components that need it.
    If the troubleshooter clears a stuck transfer state and the next Check for updates succeeds, that confirms the error was caused by a cached failed transfer.
    If 0x80240038 reappears immediately during the download phase, that confirms the upstream network path or server is still delivering an unexpected content type.
    Evidence to keep:
    Save a screenshot of the Windows Update troubleshooter diagnostic summary.

    Evidence: Microsoft Windows Update troubleshooting · Windows Update issues troubleshooting · Windows Update - additional resources

Still not solved

If the error persists, stop here. See what the technician must do and show you.

Where this code applies

A code is meaningful only inside the right product and version context.

Primary scope

System
Software and digital services
Brand
Microsoft Windows
Product type
Operating system

Known code variants

  • 0x80240038
  • Windows Update 0x80240038
  • WU_E_WINHTTP_INVALID_FILE

What it means

In Microsoft's Windows Update error reference, 0x80240038 maps to WU_E_WINHTTP_INVALID_FILE: the downloaded file has an unexpected content type. Windows Update uses WinHTTP with HTTP partial range requests (RFC 7233) to download update payloads from Microsoft endpoints or an on-premises WSUS server. When a misconfigured WinHTTP proxy, firewall download filter, or captive portal returns an HTML login or block page instead of the binary update package, WinHTTP rejects the content type with 0x80240038. The code alone never proves hardware failure or OS corruption.

Warnings and stop conditions

  • Lowsource verified

    Do not run sc.exe sdset to overwrite security ACLs on the BITS and Windows Update services during a first reset attempt; Microsoft warns that this command overwrites existing security descriptors and should be skipped unless all other reset steps have failed.

    Evidence: Windows Update - additional resources

  • Mediumsource verified

    Never permanently stop or disable the Windows Defender Firewall service or install update packages from unofficial websites; Microsoft states that stopping the Windows Firewall service is not supported and requires backing up personal files before running advanced command-line repairs.

    Evidence: Microsoft Windows Update troubleshooting · How to download updates that include drivers and hotfixes from the Microsoft Update Catalog · Windows Update issues troubleshooting

Symptoms and causes

Probable causes · in order

  • WinHTTP download received an unexpected Content-Type instead of the update payloadConfirmed

    Microsoft's Windows Update error reference defines 0x80240038 (WU_E_WINHTTP_INVALID_FILE) as the condition where the downloaded file has an unexpected content type.

    Evidence: Windows Update error reference

  • Firewall web filter, proxy server, or captive portal intercepting WinHTTP range requestsCommon

    Microsoft documents that Windows Update uses WinHTTP with Partial Range requests (RFC 7233) and warns that firewall download filtering or misconfigured WinHTTP proxy settings can cause incorrect responses to be received by the Windows Update client.

    Evidence: Common Windows Update errors · Windows Update issues troubleshooting · Netsh.exe commands - Win32 apps

  • Corrupted or truncated partial files cached in C:\Windows\SoftwareDistributionPossible

    If an intercepted download left invalid files in the local update cache, Microsoft recommends clearing or renaming the SoftwareDistribution\DataStore, SoftwareDistribution\Download, and catroot2 folders so the client downloads a clean copy.

    Evidence: Common Windows Update errors · Microsoft Windows Update troubleshooting · Windows Update - additional resources

Virtual technician

Does 0x80240038 still appear after these checks?

Answer a few questions to narrow down the likely cause and the safest next action. Guidance only - it never replaces a professional.

Start diagnosis

Sources and technical references

  1. 1

    Windows Update error reference

    Microsoft · 2026 · official_doc

Sources: Windows Update error referencereviewed 2026-10-19 · verified

Was this entry useful?