well he should get the md5checksum from the sourceforge site and check the files he's downloaded just to make sure it's not been tampered.