If the client machine doesn't have Internet Explorer 5 (or greater) installed, AUTORUN.EXE
fails gracefully by starting Windows Explorer.
When I attempted to find out what happens when the user has disabled scripting (by setting the "Active Scripting" option to disabled for the Local Intranet zone), nothing happened. HTML applications appear to ignore the Internet security settings, which makes sense, because they're treated as "local" applications.
You can modify the sample code from this article to fit the visual style you want to project, and to check for whatever third-party applications you need. When you create your own HTA CD-Launcher, don't underestimate the benefit of promoting other products and services, and of "branding" your installationlinks to your other products or services can have more "click-through" appeal than in your Web site when presented as part of your setup.
Check out DevX's Project Cool and Web Development Zone for ideas on how to make your launcher even more visually impressive by using Flash, DirectX and DHTML.