1. A computer program product embodied on a non-transitory tangible computer readable medium for performing operations, comprising: using a profiling agent to monitor a plurality of update services that are associated with multiple update providers, wherein the profiling agent includes a proxy interface; identifying an update for a computer using the proxy interface, wherein the proxy interface is configured to monitor operations performed by an operating system and one or more applications of the computer for identifying the update; downloading the update; populating a list of known wanted data with at least a portion of update data provided in the update, wherein the list reflects an aggregation of multiple update data sets from the multiple update providers and the list is based, at least in part, on the operating system and applications of the computer, and wherein the portion of the update data are reflective of data predetermined to exclude malware, and wherein the known wanted data includes a whitelist; populating the list of known wanted data with metadata that indicates a version of the update data, a digital signature used to sign a portion of the update data, and a location from which the portion of the update data was received; installing the update; tracking copied files by the profiling agent; and updating a whitelist database with the digital signature generated by the profiling agent.