The Morris worm is certainly the more historically important one but AFAIK nothing has ever beaten SQL Slammer (2003) for sheer sleekness and propagation speed: 376 bytes, sent as UDP packets to randomly generated IP addresses as fast as the network interface could pump them out. Infected all susceptible hosts on the entire Internet within 10 minutes. Thankfully, that was only MSSQL servers and, being that sleek, it had no persistence mechanism. So turning the machine off and on again removed the infection completely.