Short answer yes, but vms add an additional layer of complexity.
A hypervisor creates an additional attack surface. Not only do you have to worry about the traditional risks that exist in a physical environment, but now you have to worry about the hypervisor itself. If it is compromised, all components of the system are therefore compromised. Misconfiguration of the hypervisor could result in a single point of failure / compromise that now affects every VM on it. So, you have to make sure that you (at a minimum) restrict it according to least privilege, "need to know" and make sure your monitor it (but that's another problem because VM monitoring is not as mature as traditional...)
The additional layers of complexity that result from dealing with a VM (especially if you put a virtual firewall in) give you more of an opportunity to make a mistake.
You also have to make sure you setup user accounts correctly. Misconfiguring the VM users and accidentally allowing too many privileges to a given user, (potentially) gives them access to LOTS more than your simple mistake.
Then you have to worry about old VMs that are "off" and unused. Power cycle the box, and forget that it's set to autostart and you've added a machine to the network that isn't being maintained.
Snapshots add another problem. Sure, it's nice to do a snapshot for an update to prevent the update from taking down the whole system, but you have to be careful that you properly manage that so you don't accidentally leave payment card information vulnerable in the snapshot.
Information may also leak between components, so you have to gaurd against that as well.
And, of course, the hypervisor itself is yet another thing that must be updated, maintained, and secured on a regular basis.
So, there is a trade off between the convenience of using a vm box to host your components and the added complexity and tasks required to keep it secure.
So, long conclusion: sure. You can make it PCI compliant. It just takes a little more effort to deal with the complexities.