Telerik has a great blog post on how to figure out where a bad WebResource.axd request is coming from.
When you use firebug you just see a string of seemingly garbage appended to WebResource.axd. The post by Hristo gives you an aspx page you can drop into your site which will accept that WebResource URL and decrypt if for you!