It is definitely a confusing concept, it's hard to talk about because the terms overlap each other somewhat.
A Desktop Module (which I'll just call a module) is the largest unit of modularity in DNN. It is what you see in the Add New Module drop down list, and it is what you see in the Host->Module Definitions page.
A module contains Module Definitions (which I'll just call a definition). The vast majority of modules have only one definition; however, modules such as the core Blog module make use of the ability to have multiple definitions. When you drop a Blog module on a page, you will actually get four or five different module instances (which I'll just call a instance), which are the things you can see on the page with borders, that can individually be moved around or deleted. Again, most modules will only produce one instance when dropped on a page, but if it has multiple definitions, each of those definitions will appear as a separate instance.
A definition constains Module Controls (which I'll just call a control). These are different views within the definition. In a simple module you will have a view control and an edit control. This is the level where security permissions take place. You want to make sure that your edit control is set as an Edit type of control, so that only users who have permission to edit that module can see the control.
In a manifest file, modules are folders, definitions are modules, controls are controls, and control permissions are set as types.
I hope this made some sense and was able to help you grasp these concepts a bit better. Let me know if you have any further questions.