The main hook they use is the Windows Event Viewer, which often lists errors and warnings for system events, but they are normally benign and don't impact you or your use of the machine in any way. I have pasted an example of my own below:
As you can see, there are many errors and warnings, and that's fine. If you looked at your own it would look very much the same. It's an administrative tool that allows investigation of any system trouble that causes serious problems, but these rarely do. It looks serious, however, and I can understand why someone would fall for a caller claiming it shows a seriously compromised system.
These scammers are patient, and persistent. The best thing to do if you get a call like this is to tell them you know it's a scam, they'll scream profanities, and hang up. If you know anyone who might fall for it let them know as well, otherwise they could find themselves out of money and their sensitive data posted online.
Or, you could just turn the tables (this article, and the comments, are hilarious yet sad. I encourage you to read it to see what these people will do to get at your system and the clever ways people foil them).
