Upgrade from Magento 1.5 to 1.9

I'm not 100 sure but I think it has something to do with the status or visibility or the product.
In the products grid, when retrieving the collection there are 2 inner joins for selecting the status and visibility. (actually there is a third one, for the name but I doubt this is the problem).
If there are no values for visibility and status the product does not appear in the grid.
To test this, edit any product in the backend, then look in the table catalog_product_entity for a record that does not appear in the grid.
Change the id in the url with the one from the product that does not appear and you should be able to edit it. Set a visibility and status and save. If it appears after that int he grid then this is the problem for sure.

TO solve it, make all your products enabled and visible with this script. You can disable later the ones you don't need.

Crete a file called fix.php in the root of the magento instance with this code

<?php
error_reporting(E_ALL | E_STRICT);
define('MAGENTO_ROOT', getcwd());
$mageFilename = MAGENTO_ROOT . '/app/Mage.php';
require_once $mageFilename;
Mage::app();
$ids = Mage::getModel('catalog/product')->getCollection()->getAllIds();
Mage::getSingleton('catalog/product_action')->updateAttributes(
    $ids,
    array('status'=>1, 'visibility'=>4),
    0
);

First, the obvious: updating/patching Magento will only prevent future attacks but does not make an already compromised installation secure.

Copying the files to your local machine is not dangerous as long as you just do it to analyze the files and don't set up a local web server. Back up the files on the server itself is an option, but since the server is still compromised, be aware that the files might still get messed with. Also, it is likely that there are malicious scripts hidden in your "necessary files", for example in your theme.

What should you do with the hacked installation?

1. Take it offline. That is, not just put the store into "maintenance mode", but disable the virtual host or block all access.
2. Find and delete the malicious files. A common pattern is that PHP files are placed on the server that execute arbitrary code if accessed by a certain IP range and get the code passed as URL parameter. It might also be a modified existing file. Also, those tend to recreate themselves (for example, modified core file A creates backdoor file B everytime it is loaded). Searching for base64 and eval in all PHP files on the server is a good start. Don't forget media and var directories, those are popular to hide backdoors because they are usually less monitored. There are also tools that might help you. But in doubt, find a security expert to review the code.
3. Find malicious extensions: A possible attack is to gain access to the Magento admin panel and install a "file manager" extension. Check if any extensions have been installed recently that you don't know. Also check the admin_user database table for additional admin accounts and remove them.
4. Change all passwords (Magento admin, database, ...).
5. Install all security patches for your Magento version (a fully patched Magento 1.7 is as secure as Magento 1.9, so I'd save the hassle of updating for later)
6. Update your extensions and theme, as they are also a potential source of exploits
7. If other applications are running on the same environment (for example Wordpress), check and update them as well
8. Go online again. Or even better: back up your database and the files that you need, wipe the server and set it up from scratch.