On a Mac, how are connections (possibly by spyware) made to outside internet addresses during initial startup?

It's one step removed, but all process which run run automatically on OS X are run by launchd. You can use the launchctl command line tool list the tasks it knows about. This Apple article on launchd lists it's configuration directories, where tasks are defined.