Are there, or have there ever been viruses that completely evade all virus scanners for a long time (e.g. longer than a year?)
Yes, consistently. Viruses must be used and found before a definition is created. APT (Advanced Persistent Threats) are a huge deal in recent times where people will spend years developing viruses, called 0 day threats, for specific targets that will remain undetected for very long periods of time. Viruses like these are usually a product of nation states as most common miscreants won't spend the time or have the sophistication to pull it off. I believe Stuxnet is one of these viruses (http://en.wikipedia.org/wiki/Stuxnet) that went a year or longer before being found out and once it was, other miscreants altered the code to do what they wanted the virus to do. It's likely more common than anyone would like to believe.
Red October: http://www.kaspersky.com/about/news/virus/2013/Kaspersky_Lab_Identifies_Operation_Red_October_an_Advanced_Cyber_Espionage_Campaign_Targeting_Diplomatic_and_Government_Institutions_Worldwide
Yes. Stuxnet was being used to attack the Iranian nuclear facilities in 2007, but wasn't detected by AV or the public until June 2010. Part of its construction was designed to resist analysis by encrypting the payload against a value that could only be derived by a valid target system - it didn't appear to do anything particularly malicious outside of that payload.
It's not just malware, either. Bugs like Heartbleed and Shellshock are thought to have been exploited months or years in advance of disclosure. It was only once the exploit packets were known about that people were able to go back through their packet captures and identify cases where they may have been breached.