Both of my downloads came from http://voxel.dl.sourceforge.net
(New York, New York) which is also SourceForge's "direct link". This time I'll try from the San Jose, California, mirror at http://internap.dl.sourceforge.net
and let you know what the results are.
Following up on my topic MD5 Checksums Do Not Match, I've discovered that the XAMPP 1.6.8 Win Installer (.exe) file available from the New York City, NY, USA mirror at http://voxel.dl.sourceforge.net
generates an MD5 checksum (3362dfcf4e91d8d5ce62685bbbbcbbed) that does not match the one published on the Apache Friends website (9fe3b33e571ee57d02cb5ebdc888865f). It does, however, appear to install & run properly on a Win XP SP2 box. I've downloaded from this mirror twice at home and once at school, and all three times it yields the same MD5, so this is not an error in my downloading.
The download available from the San Jose, California, USA mirror at http://internap.dl.sourceforge.net
appears to be good and yields the correct MD5.
Comparing the file sizes, the one from San Jose is 39,359,986 bytes while the one from NYC is 39,362,474 bytes.