The OP is specifically installing non-cdp content.
DLS content is one thing, but I wouldn't be double-clicking a cdp downloaded form anywhere else.
There is nothing to stop some mug hacking checkrail and replacing pickaname.cdp with pickaname.cdp.exe - it can have the usual Trainz icon and you could be executing absolutely anything.
ALWAYS install non-DLS content by dragging it into CMP, not by double clicking.
@ Post 3 - if your 'folder' contains only Trainz content just dragging it into CM will work fine...
Andy