Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure? I am developing a symmetric en-/decryption routine written in c# for a database containing user-specific, sensitive information. 

I have narrowed down the implementation to 3 different approaches, but simply cannot determine which is the "best". So, which of these is the most secure? 


AES in GCM mode. Using either BouncyCastle or CLR Security implementation.
For those who don't know, GCM mode utilizes CTR mode with a provided counter (not sure of the exact implementation) and an additional message authentication process (definitely not HMAC)
AES in CTR mode. Using Bouncy or CLR security again. In this instance I would use the .net HMAC and utilize a 16 byte IV randomly generated (securely) as the unique nonce. 
AES in CBC mode. Using the .NET implementation. Again the HMAC from .net and rand IV. 


The simpler the better cause I'll probably mess it up

Thanks a bunch
GCM mode is best, as it can not be attacked using padding oracle attacks, which are much more common than commonly thought. It is also the only one providing integrity protection, something that is certainly much overlooked.

Make really sure your NONCE is random though, or use one that is uniquely defined (even in time) within the database.

SquareRootOfTwentyThree makes a valid objection to say that the comparision should have been between GCM mode and symmetric ciphers + HMAC. There are several reasons why I would favor GCM mode over HMAC:


two separate/unrelated keys are needed for encryption and HMAC
you need to match the security of the hash in the HMAC with that for encryption
there is more room for error when using HMAC (provide a MAC over the wrong data)
you need to communicate two different algorithms to the other party
you need to check if HMAC is actually performed


This is opinionated as all can be made secure.

The last point about the HMAC check sounds obvious, but see what happened to XML encryption in WS-security where in most implementations the signature validation could be switched off, leading to padding oracle attacks. Creating a protocol that simply performs GCM mode has fewer points of failure.

Note that the drawback regarding the NONCE mentioned by CodesInChaos is a valid one. Unfortunately any of these algorithms is affected if the IV or NONCE is not used correctly.

GCM is started to be used by updates of several protocols (TLS, XML encryption) and has been approved by NIST.