or their internet explorers settings don't allow flash, how can I make a back up plan so that they can still use my site?

I have a flash banner/menu with html site, when I checked it with windows explorer (I always use firefox) the flash came up as a "risk" or something and I had to change some setting to allow it. Is there anything I can do in the worst case scenario in that they can't view my flash banner?

You can simply apply a redirect where the flash plugin doesn't exist and point it to an html version instead. IE7 blocks flash and any activeX as a default security setting. I know a few webmasters actually will use the redirect to a page explaining the steps to a user how to turn these security filters off. But that's up to you either way.