As long as my server's crypted, Windows Defender or any antivirus will not be able to detect it. Anyhow, if he is smart enough, he could get the process name running in the background in Task Manager and shut it down for good, and in that case, I always name my servers as real Windows processes with actual icons. In that way, the victim will be tricked and he will not be able to notice any difference in his desktop/laptop/tablet.