It was 99:99, but same result with 0:0
that is uninformative to me (other than 0:0) , as unix user/groups by number are specific to an installation (they are ordinals).
http://en.wikipedia.org/wiki/User_identifier1st - Try to change the ownership to nobody:root and see if that fixes the issue. (although if the permissions are 644, a webuser 'should' be able to read the files)
Other possibilities, there is an .htaccess file in the root of htdocs or in the .htdocs/webalizer folder, that changes the URL or denies the permissions.
OR - an Alias or a symbolic link to webalizer that points to a different location.
OR - try removing 'webalizer' from the LocationMatch directive in /opt/lampp/etc/extra/httpd-xampp.conf (this would be a by product of either 'security fix' or changes to the IP ranges)
one last thing I thought about - what is your SE Linux policy???
Good Luck