I just ran into this on a fresh, never plugged into the net, install of 12.10. Turns out its just the way chkrootkit reacts to dhclient because its passing raw packets. I did 5 fresh installs and 3 low level formats in 3 days over this and your .noinit flag. I checked my dvd against sha256 and all so my install medium is legit. If you can get false positives with modern paid-for solutions, im sure open-source solutions are no different.