Not sure what that means, except (perhaps) is Avast Antivirus giving you "odd" messages about .cdp files? There have been a few posts in these forums that have criticised Avast for its "over sensitivity".
In any case there are no executables in .cdp files. The only thing that comes close to executables are scripts but these only execute within Trainz itself, not in the OS. Scripts cannot (as far as I know) access files that are outside the Trainz content database (i.e. other assets that can be found in Content Manager).
As for Malware - you can embed web pages in a Trainz asset (HTML assets for example) but these allow only a very small subset of HTML and cannot access any web sites outside of the Trainz forums (here) or the Trainz Wiki.